Vulnerability Bulletins |
Cisco Jabber STARTTLS Downgrade Vulnerability |
|
| Affected software | Cisco |
|
A vulnerability in the Cisco Jabber client could allow an unauthenticated, remote attacker to perform a STARTTLS downgrade attack. The vulnerability exists because the client does not verify that an Extensible Messaging and Presence Protocol (XMPP) connection has been established with Transport Layer Security (TLS). An attacker could exploit this vulnerability by performing a man-in-the-middle attack to tamper with the XMPP connection and avoid TLS negotiation. A successful exploit could allow More info: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151224-jab?vs_f=Cisco%20Security%20Advisory&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Cisco%20Jabber%20STARTTLS%20Downgrade%20Vulnerability&vs_k=1 |
|