PT-2017-3594 · Cisco · Cisco Webex Meetings+3
Publicado
2017-11-29
·
Atualizado
2019-10-09
·
CVE-2018-0104
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Cisco WebEx Meetings Server (affected versions not specified)
Cisco WebEx Meetings (affected versions not specified)
Cisco WebEx Business Suite (affected versions not specified)
Cisco WebEx Network Recording Player (affected versions not specified)
Description:
The issue is related to insufficient input validation, allowing a remote attacker to execute arbitrary code by using a specially crafted Advanced Recording Format (ARF) file. An attacker could exploit this by sending a malicious ARF file to a user via a link or email attachment and persuading the user to open it. Successful exploitation could allow the attacker to execute arbitrary code on the user's system.
Recommendations:
For Cisco WebEx Meetings Server, update to a version that includes the fix for this issue.
For Cisco WebEx Meetings, update to a version that includes the fix for this issue.
For Cisco WebEx Business Suite, update to a version that includes the fix for this issue.
For Cisco WebEx Network Recording Player, update to a version that includes the fix for this issue.
As a temporary workaround, consider restricting the use of ARF files until a patch is available.
Avoid opening suspicious ARF files from untrusted sources to minimize the risk of exploitation.
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Cisco Webex Business Suite
Cisco Webex Meetings
Cisco Webex Meetings Server
Cisco Webex Network Recording Player