Open the file on your computer and follow the prompted installation instructions.Download the Cisco Jabber Installation file for Windows (i.e., 'CiscoJabber-Install-ffr.14-0- 2.zip').

'The security of these applications is therefore paramount, and it is important to ensure that both the applications themselves, and the infrastructure they are using, are regularly audited for security gaps.Note: If you are a MiWorkspace user, follow the process listed at MiWorkspace: Install Software/Manage Updates (Windows) to download Cisco Jabber from the Software Center (instead of following steps one and two laid out below). 'A lot of sensitive information is shared through video calls or instant messages and the applications are used by the majority of employees, including those with privileged access to other IT systems.' 'Given their newfound prevalence in organizations of all sizes, these applications are becoming an increasingly attractive target for attackers,' Watchcom said. With video conferencing applications becoming popular in the wake of the pandemic, it's essential that Jabber users update to the latest version of the software to mitigate the risk.

To achieve this, it takes advantage of a separate vulnerable function in Chromium Embedded Framework ( CEF) - an open-source framework that's used to embed a Chromium web browser within other apps - that could be abused by a bad actor to execute rogue '.exe' files on the victim's machine.Īttackers, however, are required to have access to their victims' XMPP domains to send the malicious XMPP messages needed to exploit the vulnerability successfully.Īdditionally, three other flaws in Jabber (CVE-2020-3430, CVE-2020-3498, CVE-2020-3537) could be exploited to inject malicious commands and cause information disclosure, including the possibility of stealthily collecting users' NTLM password hashes. 'The application does not properly sanitize incoming HTML messages and instead passes them through a flawed XSS filter,' Watchcom researchers explained.Īs a consequence, a legitimate XMPP message can be intercepted and modified, thereby causing the application to run an arbitrary executable that already exists within the local file path of the application.

The flaw in Cisco Jabber arises from cross-site scripting (XSS) vulnerability when parsing XHTML-IM messages.

Cisco jabber for windows youtube