Denial of Service Vulnerability in Cisco Jabber Extensible Communications Platform
CVE-2011-3287

Currently unrated

Key Information:

Vendor
Cisco
Status
Jabber Extensible Communications Platform
Vendor
CVE Published:
6 October 2011

Summary

The Cisco Jabber Extensible Communications Platform versions 2.x to 5.4.x (prior to 5.4.0.27581) and 5.8.x (prior to 5.8.1.27561) contains a vulnerability that fails to properly manage recursion during entity expansion. This weakness allows remote attackers to exploit the system by sending a specially crafted XML document with numerous nested entity references, leading to excessive memory and CPU usage, ultimately resulting in a denial of service due to process crashes.

References

http://www.cisco.com/en/US/products/products_security_adv...
vendor-advisoryx_refsource_CISCO

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.