PT-2019-4237 · Cisco · Cisco Webex Team+2
John Tear
·
Published
2019-11-20
·
Updated
2019-12-11
·
CVE-2019-16001
CVSS v3.1
5.3
Medium
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Cisco Webex Teams for Windows (affected versions not specified)
Cisco Webex Meetings Client (affected versions not specified)
Cisco Webex Team (affected versions not specified)
Description
A vulnerability in the loading mechanism of specific dynamic link libraries could allow an authenticated, local attacker to perform a DLL hijacking attack. The vulnerability is due to insufficient validation of the resources loaded by the application at run time. An attacker could exploit this vulnerability by crafting a malicious DLL file and placing it in a specific location on the targeted system. The malicious DLL file would execute when the vulnerable application is launched. A successful exploit could allow the attacker to execute arbitrary code on the target machine with the privileges of another user account.
Recommendations
For Cisco Webex Teams for Windows, consider disabling the loading of external DLL files until a patch is available.
For Cisco Webex Meetings Client, restrict access to the vulnerable DLL loading mechanism to minimize the risk of exploitation.
For Cisco Webex Team, avoid using the vulnerable application until a fix is provided.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Uncontrolled Search Path Element
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cisco Webex Meetings Client
Cisco Webex Team
Cisco Webex Teams For Windows