Buffer overflow in Cisco Systems, Inc products - CVE-2019-15285
Published: November 8, 2019
Vulnerability identifier: #VU22606
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-15285
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). A remote attacker can send a specially crafted ARF or WRF file through a link or email attachment, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
Cisco Webex Meetings Online
Cisco Webex Meetings sites
Cisco WebEx Meetings Server
Cisco Webex Player
Cisco WebEx Network Recording Player
Cisco Webex Meetings sites
Cisco WebEx Meetings Server
Cisco Webex Player
Cisco WebEx Network Recording Player
How to mitigate CVE-2019-15285
Install updates from vendor's website.
Cisco Webex Meetings Online - update to 1.3.44
Cisco Webex Meetings sites - addressed in versions -, 39.5.12, 39.6.0, 39.8.0
Cisco WebEx Meetings Server - addressed in versions 3.0MR3, 4.0MR2
Cisco Webex Meetings sites - addressed in versions -, 39.5.12, 39.6.0, 39.8.0
Cisco WebEx Meetings Server - addressed in versions 3.0MR3, 4.0MR2