Vulnerabilities / Threats
2/1/2011
11:13 AM
50%
50%

Cisco Patches WebEx Bugs

Attacks could exploit stack overflows in WebEx Player and WebEx Media Center to compromise or crash computers.

Cisco Umi
Slideshow: Cisco Umi Takes Telepresence To The Home
(click image for larger view and for slideshow)

On Monday, Cisco updated its WebEx software to patch two bugs that attackers could exploit to crash or compromise a user's system.

The vulnerabilities were first identified by Core Security in October 2010. It then delayed releasing a security advisory until Cisco had time to create an emergency patch and fully distribute updates for WebEx Meeting Center, which runs in a software-as-a-service (SaaS) environment.

According to Core Security, the vulnerabilities in previous versions of WebEx Player and WebEx Meeting Center would allow an attacker to create a buffer overflow and take control of a user's machine. The buffer overflows can be triggered if users run a malicious WebEx recording file (.wrf) or Web poll questionnaire (.atp).

Numerous types of attacks are possible for exploiting the vulnerabilities. For example, publishing a malicious WebEx recording file in a WebEx meeting can compromise all meeting participants' PCs. Meanwhile, a malicious .atp file served during a meeting could disconnect the host, causing the clients to cycle the malicious file amongst themselves, while the file went about exploiting their systems.

"These files trigger a reliably exploitable stack-based buffer overflow," said Core Security. "Reliable code execution is possible because a big chunk of the stack is overwritten."

Core Security said it discovered the WebEx recording file vulnerability by fuzzing -- or altering -- a .wrf file to see what would result, which involved modifying only one byte. "A portion of the new file's execution pointed to a user call instruction and allowed a hacker to execute other functions on the machine," said Core Security. Such files, which use a closed and undocumented file format, are used to play back WebEx session recordings.

To address the WebEx Player vulnerability, Core Security recommends uninstalling any previous versions of the application and installing the latest version. Meanwhile, the WebEx Meeting Center vulnerability has been remediated by Cisco using a server-side fix.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0279
Published: 2015-03-26
JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via the do parameter.

CVE-2015-0635
Published: 2015-03-26
The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS 12.2, 12.4, 15.0, 15.2, 15.3, and 15.4 and IOS XE 3.10.xS through 3.13.xS before 3.13.1S allows remote attackers to spoof Autonomic Networking Registration Authority (ANRA) responses, and consequently bypass intended device an...

CVE-2015-0636
Published: 2015-03-26
The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS 12.2, 12.4, 15.0, 15.2, 15.3, and 15.4 and IOS XE 3.10.xS through 3.13.xS before 3.13.1S allows remote attackers to cause a denial of service (disrupted domain access) via spoofed AN messages that reset a finite state machine,...

CVE-2015-0637
Published: 2015-03-26
The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS 12.2, 12.4, 15.0, 15.2, 15.3, and 15.4 and IOS XE 3.10.xS through 3.13.xS before 3.13.1S allows remote attackers to cause a denial of service (device reload) via spoofed AN messages, aka Bug ID CSCup62315.

CVE-2015-0638
Published: 2015-03-26
Cisco IOS 12.2, 12.4, 15.0, 15.2, and 15.3, when a VRF interface is configured, allows remote attackers to cause a denial of service (interface queue wedge) via crafted ICMPv4 packets, aka Bug ID CSCsi02145.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.