PT-2017-17292 · Mozilla+3 · Firefox+6

Published 2017-07-25 · Updated 2019-10-09 · CVE-2017-6753

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco WebEx browser extensions versions prior to 1.0.12

Description A design defect in the Cisco WebEx browser extensions for Google Chrome and Mozilla Firefox could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the affected browser on an affected system. The vulnerability affects the browser extensions for Cisco WebEx Meetings Server, Cisco WebEx Centers, and Cisco WebEx Meetings when they are running on Microsoft Windows. An attacker who can convince an affected user to visit an attacker-controlled web page or follow an attacker-supplied link with an affected browser could exploit the vulnerability, potentially executing arbitrary code with the privileges of the affected browser.

Recommendations For versions prior to 1.0.12 of the Cisco WebEx browser extensions, update to version 1.0.12 or later to resolve the issue. As a temporary workaround, consider disabling the affected browser extensions until a patch is available. Restrict access to potentially vulnerable web pages to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2017-6753

Affected Products

Cisco Webex Centers

Cisco Webex Meetings

Cisco Webex Meetings Server

Cisco Webex Browser Extensions

Google Chrome

Windows

Firefox

References · 7

• https://osv.dev/vulnerability/CVE-2017-6753 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6753 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170717-webex · Vendor Advisory
• http://securitytracker.com/id/1038910 · Note
• http://securityfocus.com/bid/99614 · Note
• http://securitytracker.com/id/1038911 · Note
• http://securitytracker.com/id/1038909 · Note