Cisco WebEx Teams on Windows DLL Loader uncontrolled search path

Summaryinfo

A vulnerability marked as critical has been reported in Cisco WebEx Teams on Windows. This impacts an unknown function of the component DLL Loader. This manipulation causes uncontrolled search path. This vulnerability appears as CVE-2019-16001. The attack requires local access. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Cisco WebEx Teams on Windows (Unified Communication Software) (the affected version is unknown) and classified as critical. Affected by this vulnerability is an unknown code of the component DLL Loader. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. The CWE definition for the vulnerability is CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the loading mechanism of specific dynamic link libraries in Cisco Webex Teams for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of the resources loaded by the application at run time. An attacker could exploit this vulnerability by crafting a malicious DLL file and placing it in a specific location on the targeted system. The malicious DLL file would execute when the vulnerable application is launched. A successful exploit could allow the attacker to execute arbitrary code on the target machine with the privileges of another user account.

The weakness was presented 11/26/2019 as cisco-sa-20191120-webex-teams- as confirmed advisory (Website). The advisory is shared at tools.cisco.com. This vulnerability is known as CVE-2019-16001 since 09/06/2019. An attack has to be approached locally. A single authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1574 for this issue.

Upgrading eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Unified Communication Software

Vendor

• Cisco

Name

• WebEx Teams

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion