SB2018100307 - Remote code execution in Cisco Webex Network Recording Player and Webex Player
Published: October 3, 2018 Updated: October 9, 2018
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 13 secuirty vulnerabilities.
1) Improper input validation (CVE-ID: CVE-2018-15408)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper validation of Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. A remote unauthenticated attacker can trick the victim into opening a specially crafted ARF or WRF file sent via a link or an email attachment and execute arbitrary code
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
2) Improper input validation (CVE-ID: CVE-2018-15409)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper validation of Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. A remote unauthenticated attacker can trick the victim into opening a specially crafted ARF or WRF file sent via a link or an email attachment and execute arbitrary code
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) Improper input validation (CVE-ID: CVE-2018-15410)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper validation of Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. A remote unauthenticated attacker can trick the victim into opening a specially crafted ARF or WRF file sent via a link or an email attachment and execute arbitrary code
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
4) Improper input validation (CVE-ID: CVE-2018-15411)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper validation of Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. A remote unauthenticated attacker can trick the victim into opening a specially crafted ARF or WRF file sent via a link or an email attachment and execute arbitrary code
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
5) Improper input validation (CVE-ID: CVE-2018-15412)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper validation of Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. A remote unauthenticated attacker can trick the victim into opening a specially crafted ARF or WRF file sent via a link or an email attachment and execute arbitrary code
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
6) Improper input validation (CVE-ID: CVE-2018-15413)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper validation of Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. A remote unauthenticated attacker can trick the victim into opening a specially crafted ARF or WRF file sent via a link or an email attachment and execute arbitrary code
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
7) Improper input validation (CVE-ID: CVE-2018-15415)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper validation of Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. A remote unauthenticated attacker can trick the victim into opening a specially crafted ARF or WRF file sent via a link or an email attachment and execute arbitrary code
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
8) Improper input validation (CVE-ID: CVE-2018-15416)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper validation of Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. A remote unauthenticated attacker can trick the victim into opening a specially crafted ARF or WRF file sent via a link or an email attachment and execute arbitrary code
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
9) Improper input validation (CVE-ID: CVE-2018-15417)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper validation of Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. A remote unauthenticated attacker can trick the victim into opening a specially crafted ARF or WRF file sent via a link or an email attachment and execute arbitrary code
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
10) Improper input validation (CVE-ID: CVE-2018-15418)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper validation of Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. A remote unauthenticated attacker can trick the victim into opening a specially crafted ARF or WRF file sent via a link or an email attachment and execute arbitrary code
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
11) Improper input validation (CVE-ID: CVE-2018-15419)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper validation of Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. A remote unauthenticated attacker can trick the victim into opening a specially crafted ARF or WRF file sent via a link or an email attachment and execute arbitrary code
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
12) Improper input validation (CVE-ID: CVE-2018-15420)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper validation of Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. A remote unauthenticated attacker can trick the victim into opening a specially crafted ARF or WRF file sent via a link or an email attachment and execute arbitrary code
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
13) Improper input validation (CVE-ID: CVE-2018-15431)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper validation of Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. A remote unauthenticated attacker can trick the victim into opening a specially crafted ARF or WRF file sent via a link or an email attachment and execute arbitrary code
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install update from vendor's website.