CVE-2015-6409: Infoleak

Published Dec 26, 2015

Updated

Cisco Jabber 10.6.x, 11.0.x, and 11.1.x on Windows allows man-in-the-middle attackers to conduct STARTTLS downgrade attacks and trigger cleartext XMPP sessions via unspecified vectors, aka Bug ID CSCuw87419.

Affected Software

1 affected component

Cisco Jabber Windows=10.6\(2\)

Event History

Dec 26, 2015

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-6409?

CVE-2015-6409 is considered a medium severity vulnerability due to its potential for man-in-the-middle attacks.

How do I fix CVE-2015-6409?

To mitigate CVE-2015-6409, upgrade Cisco Jabber to the latest version where the vulnerability has been patched.

What types of attacks are possible with CVE-2015-6409?

CVE-2015-6409 allows attackers to conduct STARTTLS downgrade attacks resulting in cleartext XMPP sessions.

Which versions of Cisco Jabber are affected by CVE-2015-6409?

CVE-2015-6409 affects Cisco Jabber versions 10.6.x, 11.0.x, and 11.1.x on Windows.

Is CVE-2015-6409 easy to exploit?

Exploitation of CVE-2015-6409 requires access to the network where the vulnerable Cisco Jabber client resides, making it moderately challenging.