Executive Summary
| Summary | |
|---|---|
| Title | Multiple Vulnerabilities in the Cisco WebEx Recording Format and Advanced Recording Format Players |
| Informations | |||
|---|---|---|---|
| Name | cisco-sa-20140507-webex | First vendor Publication | 2014-05-07 |
| Vendor | Cisco | Last vendor Modification | 2014-05-07 |
| Severity (Vendor) | N/A | Revision | 1.0 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9.3 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Multiple buffer overflow vulnerabilities exist in the Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players. Exploitation of these vulnerabilities could allow a remote attacker to cause an affected player to crash and, in some cases, could allow a remote attacker to execute arbitrary code on the system of a targeted user. The Cisco WebEx Players are applications that are used to play back WebEx meeting recordings that have been recorded on the computer of an online meeting attendee. The players can be automatically installed when the user accesses a recording file that is hosted on a WebEx server. Cisco has updated affected versions of the Cisco WebEx Business Suite meeting sites, Cisco WebEx 11 meeting sites, Cisco WebEx Meetings Server, and Cisco WebEx WRF and ARF Players to address these vulnerabilities. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140507-webex BEGIN PGP SIGNATURE Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJTakVrAAoJEIpI1I6i1Mx3L9UP/0C/E8W9uqZ7PXRK8mmdhXZG N8r/eluyYFxieCuMf2vKRhseRy0b1r4voVT/JduymoxONoh+KcmWWpVabmXwWL7Q fhFemWAp8avu2/4bfqvUnS6k+U57ew+LhEDchGMx+j/iyv4axeCA6cBjVA3qkh/x skisxr5Sgftq2+9lPXOvh2EpDXAUV6r2f6CfxlcLJIrgYQP5SGKdb2NZX9DctgeI pBhUXMQmO4tT8/IZ1Y5h2s+9Z45iDc+sluW4YfPc5wdAwfjifTmR7Haem94mjf2Q a108I+77c8wHd1nb+KTxHOh/QhYcY64FhIbvqdjtC2CgMB1e61dlvBejnr/RVFHv +9CiiAy12vRTXCAxk/GAABCQWNVJHUEBEME/IQeaLYdDoU0x3njR2476xYogCCgg dkA9jTUPsjg6nBJl42q2Cne3cx31MUuj5zsZoxmeMXjFeTCmZlRSgr33F8uC3s3d DHRoykjLpviMS6tRVWqVyXI/5C4xfjEZPgElSJbBW9/s2MiFECb1Kbwv22lX9sai nzxqe62U0doKOqTEFi50Jd7MYuqvOZPlfZ+MCOoOn6T4m40uljjNtqEHU6S5LEYL oZ/xoqFfe3nT/4o3M4rSA9MDSqCPD/rx8sf14IMgyHoz+vCT8Zx0eaNZxDR1BbjP P/v+WwMQgOPwYp48q0Tc =k+fv END PGP SIGNATURE _______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com |
Original Source
| Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...) |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 3 | |
| Application | 3 |
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2014-05-15 | IAVM : 2014-B-0055 - Multiple Vulnerabilities in Cisco WebEX Severity : Category II - VMSKEY : V0050441 |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-06-07 | Cisco Webex ARF Player LZW decompress memory corruption denial of service att... RuleID : 30943 - Revision : 4 - Type : FILE-OTHER |
| 2014-06-07 | Cisco Webex ARF Player LZW decompress memory corruption denial of service att... RuleID : 30942 - Revision : 4 - Type : FILE-OTHER |
| 2014-06-07 | Cisco WebEx WRF heap corruption attempt RuleID : 30932 - Revision : 4 - Type : FILE-OTHER |
| 2014-06-07 | Cisco WebEx Player atas32.dll memory overread attempt RuleID : 30922 - Revision : 4 - Type : FILE-OTHER |
| 2014-06-07 | Cisco WebEx Player atas32.dll memory overread attempt RuleID : 30921 - Revision : 4 - Type : FILE-OTHER |
| 2014-06-07 | Cisco Webex WRF heap corruption attempt RuleID : 30913 - Revision : 4 - Type : FILE-OTHER |
| 2014-06-07 | Cisco Webex WRF heap corruption attempt RuleID : 30912 - Revision : 4 - Type : FILE-OTHER |
| 2014-06-07 | Cisco Webex WRF heap corruption attempt RuleID : 30903 - Revision : 4 - Type : FILE-OTHER |
| 2014-06-07 | Cisco Webex WRF heap corruption attempt RuleID : 30902 - Revision : 4 - Type : FILE-OTHER |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-05-14 | Name : The video player installed on the remote Windows host has multiple vulnerabil... File : cisco-sa-20140507-webex_arf.nasl - Type : ACT_GATHER_INFO |
| 2014-05-14 | Name : The video player installed on the remote Windows host has multiple vulnerabil... File : cisco-sa-20140507-webex_wrf.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-06-07 21:22:27 |
|
| 2014-05-15 13:24:02 |
|
| 2014-05-09 21:28:53 |
|
| 2014-05-07 21:22:57 |
|
