Remote code execution in Cisco WebEx Browser Extension

1) Memory corruption

EUVDB-ID: #VU5375

Risk: High

CVSSv3.1: 8.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C]

CVE-ID: CVE-2017-3823

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when parsing specially crafted patterns, related to WebEx session in Cisco WebEx Browser Extension for Chrome. Firefox and Internet Explorer. A remote attacker can trick the victim into visiting a specially crafted website and starting WebEx session, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code on the target system with privileges of the current user.

The affected extension is shipped with two Cisco products: Cisco WebEx Meetings Server and Cisco WebEx Meetings Center.

Mitigation

Install updates from vendor's website.

Separate updates for browser extensions can be installed via browser update functionality.

Vulnerable software versions

Cisco WebEx Meeting Center: 27.32.20 - 31

Cisco WebEx Meetings Server: 1.0 - 2.7

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170124-webex

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.