#VU5375 Memory corruption in Cisco WebEx Meeting Center and Cisco WebEx Meetings Server - CVE-2017-3823 

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU5375

#VU5375 Memory corruption in Cisco WebEx Meeting Center and Cisco WebEx Meetings Server - CVE-2017-3823

Published: January 24, 2017 / Updated: September 14, 2018


Vulnerability identifier: #VU5375
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber
CVE-ID: CVE-2017-3823
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability: Public exploit is available
Vulnerable software:
Cisco WebEx Meeting Center
Cisco WebEx Meetings Server
Software vendor:
Cisco Systems, Inc

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when parsing specially crafted patterns, related to WebEx session in Cisco WebEx Browser Extension for Chrome. Firefox and Internet Explorer. A remote attacker can trick the victim into visiting a specially crafted website and starting WebEx session, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code on the target system with privileges of the current user.

The affected extension is shipped with two Cisco products: Cisco WebEx Meetings Server and Cisco WebEx Meetings Center.


Remediation

Install updates from vendor's website.

Separate updates for browser extensions can be installed via browser update functionality.



External links