PT-2017-17292 · Mozilla+3 · Firefox+6

Publicado 2017-07-25 · Atualizado 2019-10-09 · CVE-2017-6753

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco WebEx browser extensions versions prior to 1.0.12

Description A design defect in the Cisco WebEx browser extensions for Google Chrome and Mozilla Firefox could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the affected browser on an affected system. The vulnerability affects the browser extensions for Cisco WebEx Meetings Server, Cisco WebEx Centers, and Cisco WebEx Meetings when they are running on Microsoft Windows. An attacker who can convince an affected user to visit an attacker-controlled web page or follow an attacker-supplied link with an affected browser could exploit the vulnerability, potentially executing arbitrary code with the privileges of the affected browser.

Recommendations For versions prior to 1.0.12 of the Cisco WebEx browser extensions, update to version 1.0.12 or later to resolve the issue. As a temporary workaround, consider disabling the affected browser extensions until a patch is available. Restrict access to potentially vulnerable web pages to minimize the risk of exploitation.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2017-6753

Produtos afetados

Cisco Webex Centers

Cisco Webex Meetings

Cisco Webex Meetings Server

Cisco Webex Browser Extensions

Google Chrome

Windows

Firefox

Referências · 7

• https://osv.dev/vulnerability/CVE-2017-6753 · Aviso do Fabricante
• http://securitytracker.com/id/1038910 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-6753 · Nota de Segurança
• http://securityfocus.com/bid/99614 · Nota
• http://securitytracker.com/id/1038911 · Nota
• http://securitytracker.com/id/1038909 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170717-webex · Aviso do Fabricante