CVE-2018-0449 Cisco Jabber Client Framework Insecure Directory Permissions Vulnerability

Medium 5.1 Published 10 Jan 2019 Updated 21 Nov 2024

Local attackers can corrupt arbitrary files or escalate privileges by exploiting insecure directory permissions in Cisco Jabber for Mac.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-0449?

CVE-2018-0449 is a medium-severity vulnerability in Cisco Jabber for Mac, published on 10 Jan 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability in the Cisco Jabber Client Framework (JCF) software, installed as part of the Cisco Jabber for Mac client, could allow an authenticated, local attacker to corrupt arbitrary files on an affected device that has elevated privileges. The vulnerability exists due to insecure directory permissions set on a JCF created directory. An authenticated attacker with the ability to access an affected directory could create a hard link to an arbitrary location on the affected system. An attacker could convince another user that has administrative privileges to perform an install or update the Cisco Jabber for Mac client to perform such actions, allowing files to be created in an arbitrary location on the disk or an arbitrary file to be corrupted when it is appended to or overwritten.

Weakness: CWE-732, CWE-275

Which versions are affected by CVE-2018-0449?

It affects 1 product.

Products include Cisco Jabber.

How do I fix CVE-2018-0449?

No fix has been published for CVE-2018-0449 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-0449 being exploited?

There is no known exploitation of CVE-2018-0449 in the wild and no public exploit code.

Sources

Also known as GHSA-f582-3xw4-gr8w.