Title

Cisco IP Communicator Security Bypass Vulnerability (Cat I impact)

Discussion

Cisco has released a notice addressing a security bypass vulnerability in IP Communicator. Cisco IP Communicator is a Windows PC-based softphone application that lets you use your personal computer to make voice and video calls. To exploit this vulnerability, an attacker establishes a malicious server with a certificate trusted by the vulnerable application. If successfully exploited, the attacker can perform a man-in-the-middle attack and impersonate a legitimate server to use in further attacks.

Check Content

See IAVM notice and vendor bulletin for additional information. Vulnerable Applications/Systems: Cisco IP Communicator 8.6 Verify the application's version number by using Help, About or similar menu selections. Ensure the Application/System version is at least the version listed below. Cisco IP Communicator 8.6.2 or later Windows - Alternately, verify the version through the Support information link for the program in Add or Remove Programs or Programs and Features (Vista Forward). To expose the version column in Programs and Features right click somewhere in the column headers, select More and select Version.

Fix Text

Additional Identifiers

Rule ID:

Vulnerability ID: V-33670

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.