Executive Summary

Summary
Title Cisco WebEx web browser extension allows arbitrary code execution
Informations
Name VU#909240 First vendor Publication 2017-01-27
Vendor VU-CERT Last vendor Modification 2017-01-27
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 9.3 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#909240

Cisco WebEx web browser extension allows arbitrary code execution

Original Release date: 27 Jan 2017 | Last revised: 27 Jan 2017

Overview

The Cisco WebEx extensions for Chrome, Firefox, and Internet Explorer allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable Windows system.

Description

Cisco WebEx is a suite of online meeting software. WebEx meetings are usually joined through a web browser link. The WebEx software is launched through use of a web browser extension. The Cisco WebEx web browser extension allows a remote attacker to execute arbitrary code on a vulnerable Windows system.

The WebEx Google Chrome extension versions older than 1.0.7 are affected.
The WebEx Internet Explorer GpcContainer ActiveX control version 2.1.0.9 and earlier are reported to be affected.
The WebEx Firefox ActiveTouch General Plugin Container version 3006.0.2016.222 and earlier are reported to be affected.

Exploit code for the Google Chrome extension is publicly available.

Impact

By convincing a user to visit a specially-crafted web page, a remote attacker may be able to execute arbitrary code on a vulnerable system.

Solution

Apply an update

Cisco has addressed this vulnerability in the Chrome web browser extension version 1.0.7. Please see the Cisco Security Advisory for more details. Internet Explorer, Firefox, and other Windows browser users should consider the following workarounds:

Disable the WebEx ActiveX control in Internet Explorer

The vulnerable WebEx ActiveX control can be disabled in Internet Explorer by setting the kill bit for the following CLSID:


    {E06E2E99-0AA1-11D4-ABA6-0060082AA75C}

More information about how to set the kill bit is available in Microsoft Support Document 240797. Alternatively, the following text can be saved as a .REG file and imported to set the kill bit for this control:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{    E06E2E99-0AA1-11D4-ABA6-0060082AA75C}]
    "Compatibility Flags"=dword:00000400
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{    E06E2E99-0AA1-11D4-ABA6-0060082AA75C}]
    "Compatibility Flags"=dword:00000400

Since Internet Explorer version 8, ActiveX controls require per-site activation before they execute. Note, however, that per-site ActiveX in Internet Explorer occurs on the domain level, rather than the subdomain level. For example, if a user has agreed to run the WebEx ActiveX control on any foo.webex.com domain, then it will run without prompting on any bar.webex.com domain.

Disable the WebEx plugin in Firefox

The vulnerable WebEx Firefox plugin can be disabled by visiting about:addons, viewing the Plugins section and selecting Never Activate for the ActiveTouch General Plugin Container plugin.

Note that in the default configuration of Firefox, the browser will prompt the user before running the plugin upon visiting each new subdomain. This may help prevent a "drive-by download" attack without user interaction on Firefox.

Uninstall WebEx software

According to the Cisco Security Advisory, this vulnerability can be mitigated on all browsers by running the Meeting Services Removal Tool, which is available from https://help.webex.com/docs/DOC-2672.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
CiscoAffected-27 Jan 2017
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

GroupScoreVector
Base7.5AV:N/AC:L/Au:N/C:P/I:P/A:P
Temporal6.8E:F/RL:W/RC:C
Environmental6.8CDP:ND/TD:H/CR:ND/IR:ND/AR:ND

References

  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170124-webex
  • https://help.webex.com/docs/DOC-2672
  • https://bugs.chromium.org/p/project-zero/issues/detail?id=1096
  • https://bugs.chromium.org/p/project-zero/issues/detail?id=1100
  • https://blog.filippo.io/webex-extension-vulnerability/
  • https://msdn.microsoft.com/en-us/library/dd433050(v=vs.85).aspx#_user

Credit

This vulnerability was publicly reported by Tavis Ormandy.

This document was written by Will Dormann.

Other Information

  • CVE IDs:CVE-2017-3823
  • Date Public:23 Jan 2017
  • Date First Published:27 Jan 2017
  • Date Last Updated:27 Jan 2017
  • Document Revision:17

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Original Source

Url : http://www.kb.cert.org/vuls/id/909240

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1
Application 1
Application 14
Application 36

SAINT Exploits

Description Link
WebEx browser extension command execution More info here

Snort® IPS/IDS

Date Description
2017-01-27 Cisco Webex explicit use of web plugin detected
RuleID : 41409-community - Revision : 7 - Type : POLICY-OTHER
2017-02-25 Cisco Webex explicit use of web plugin detected
RuleID : 41409 - Revision : 6 - Type : POLICY-OTHER
2017-02-25 Cisco WebEx extension command execution attempt
RuleID : 41408 - Revision : 3 - Type : BROWSER-OTHER
2017-02-25 Cisco WebEx extension command execution attempt
RuleID : 41407 - Revision : 3 - Type : BROWSER-OTHER

Nessus® Vulnerability Scanner

Date Description
2017-01-31 Name : A browser extension installed on the remote host is affected by a remote code...
File : cisco_webex_extension_rce_firefox.nasl - Type : ACT_GATHER_INFO
2017-01-31 Name : A browser extension installed on the remote host is affected by a remote code...
File : cisco_webex_extension_rce_ie.nasl - Type : ACT_GATHER_INFO
2017-01-25 Name : A browser extension installed on the remote host is affected by a remote code...
File : cisco_webex_extension_rce.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
Date Informations
2017-10-10 09:25:11
  • Multiple Updates
2017-02-01 13:25:46
  • Multiple Updates
2017-01-27 21:23:16
  • First insertion