PT-2011-1391 · Cisco · Cisco Webex Recording Format (Wrf)/Advanced Recording Format (Arf) Players

Published 2011-02-02 · Updated 2018-10-10 · CVE-2010-3269

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players T27LB before SP21 EP3 Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players T27LC before SP22

Description The issue is related to multiple stack-based buffer overflows in the Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players. This allows remote attackers to execute arbitrary code via a crafted (1) .wrf or (2) .arf file. The problem is connected to the use of a function pointer in a callback mechanism.

Recommendations For Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players T27LB before SP21 EP3, update to SP21 EP3 or later. For Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players T27LC before SP22, update to SP22 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2010-3269

Affected Products

Cisco Webex Recording Format (Wrf)/Advanced Recording Format (Arf) Players

References · 9

• http://cisco.com/en/US/products/products_security_advisory09186a0080b6913f.shtml · Vendor Advisory
• http://coresecurity.com/content/webex-atp-and-wrf-overflow-vulnerabilities · Patch
• http://tools.cisco.com/security/center/viewAlert.x?alertId=22016 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2010-3269 · Security Note
• http://vupen.com/english/advisories/2011/0261 · Vendor Advisory
• http://securityfocus.com/archive/1/516095/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65076 · Note
• http://securitytracker.com/id?1025015 · Note
• http://securityfocus.com/bid/46075 · Note