Cisco WebEx Business Suite Client SWF File input validation

Summaryinfo

A vulnerability was found in Cisco WebEx Business Suite Client, WebEx Meetings and WebEx Meetings Server. It has been classified as critical. Affected is an unknown function of the component SWF File Handler. This manipulation causes input validation. This vulnerability appears as CVE-2018-0112. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Cisco WebEx Business Suite Client, WebEx Meetings and WebEx Meetings Server (Unified Communication Software) (unknown version). It has been declared as critical. Affected by this vulnerability is an unknown code block of the component SWF File Handler. The manipulation with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in Cisco WebEx Business Suite clients, Cisco WebEx Meetings, and Cisco WebEx Meetings Server could allow an authenticated, remote attacker to execute arbitrary code on a targeted system. The vulnerability is due to insufficient input validation by the Cisco WebEx clients. An attacker could exploit this vulnerability by providing meeting attendees with a malicious Flash (.swf) file via the file-sharing capabilities of the client. Exploitation of this vulnerability could allow arbitrary code execution on the system of a targeted user. This affects the clients installed by customers when accessing a WebEx meeting. The following client builds of Cisco WebEx Business Suite (WBS30, WBS31, and WBS32), Cisco WebEx Meetings, and Cisco WebEx Meetings Server are impacted: Cisco WebEx Business Suite (WBS31) client builds prior to T31.23.2, Cisco WebEx Business Suite (WBS32) client builds prior to T32.10, Cisco WebEx Meetings with client builds prior to T32.10, Cisco WebEx Meetings Server builds prior to 2.8 MR2. Cisco Bug IDs: CSCvg19384, CSCvi10746.

The bug was discovered 04/18/2018. The weakness was presented 04/19/2018 by Alex as cisco-sa-20180418-wbs as confirmed advisory (Website). It is possible to read the advisory at tools.cisco.com. This vulnerability is known as CVE-2018-0112 since 11/27/2017. The attack can be launched remotely. The requirement for exploitation is a single authentication. The technical details are unknown and an exploit is not publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $5k-$25k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 316359 (Cisco Meeting Server Remote Code Execution Vulnerability (cisco-sa-20180418-wbs)).

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 103920†). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Unified Communication Software

Vendor

• Cisco

Name

• WebEx Business Suite Client
• WebEx Meetings
• WebEx Meetings Server

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion