Security News > 2020 > December > The patch that wasn't: Cisco emits fresh fixes for NTLM hash-spilling vuln and XSS-RCE combo in Jabber app
A previous patch for Cisco's Jabber chat product did not in fact fix four vulnerabilities - including one remote code execution flaw that would allow malicious people to hijack targeted devices by sending a carefully crafted message.
Watchcom added: "The patch released in September only patched the specific injection points that Watchcom had identified. The underlying issue was not addressed. We were therefore able to find new injection points that could be used to exploit the vulnerabilities."
The NTLM password hash can be collected, Watchcom added, by "Sending a message that contains a malicious tag, an attacker can force the victim's Cisco Jabber client to interact with a file share the attacker controls."
"Following the release of software fixes on September 2, Cisco and a security researcher independently discovered additional, distinct vulnerabilities through testing. We followed our well-established security vulnerability process to address and disclose these vulnerabilities on December 10. Cisco maintains a very open relationship with the security community, and we view this as vital to helping protect our customers' networks. We thank the security researchers at Watchcom for reporting the vulnerabilities they discovered."
Admins whose orgs use Cisco Jabber should install the latest patches from Cisco, which are available here.