[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Full-disclosure] Cisco Security Advisory: Buffer Overflow Vulnerabilities in the Cisco WebEx Player
- To: full-disclosure@xxxxxxxxxxxxxxxxx
- Subject: [Full-disclosure] Cisco Security Advisory: Buffer Overflow Vulnerabilities in the Cisco WebEx Player
- From: Cisco Systems Product Security Incident Response Team <psirt@xxxxxxxxx>
- Date: Wed, 26 Oct 2011 12:20:47 -0400
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Cisco Security Advisory: Buffer Overflow Vulnerabilities in the Cisco WebEx
Player
Advisory ID: cisco-sa-20111026-webex
Revision 1.0
For Public Release 2011 October 26 16:00 UTC (GMT)
+----------------------------------------------------------------
Summary
=======
Multiple buffer overflow vulnerabilities exist in the Cisco WebEx
Recording Format (WRF) player. In some cases, exploitation of the
vulnerabilities could allow a remote attacker to execute arbitrary
code on the system with the privileges of a targeted user.
The Cisco WebEx Players are applications that are used to play back
WebEx meeting recordings that have been recorded on a WebEx meeting
site or on the computer of an online meeting attendee. The players
can be automatically installed when the user accesses a recording
file that is hosted on a WebEx meeting site. The players can also be
manually installed for offline playback after downloading the
application from www.webex.com
If the WRF player was automatically installed, it will be
automatically upgraded to the latest, nonvulnerable version when
users access a recording file that is hosted on a WebEx meeting site.
If the WRF player was manually installed, users will need to manually
install a new version of the player after downloading the latest
version from www.webex.com
Cisco has released free software updates that address these
vulnerabilities.
This advisory is posted at:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111026-webex
Note: Effective October 18, 2011, Cisco moved the current list of
Cisco Security Advisories and Responses published by Cisco PSIRT. The
new location is http://tools.cisco.com/security/center/publicationListing
You can also navigate to this page from the Cisco
Products and Services menu of the Cisco Security Intelligence
Operations (SIO) Portal. Following this transition, new Cisco
Security Advisories and Responses will be published to the new
location. Although the URL has changed, the content of security
documents and the vulnerability policy are not impacted. Cisco will
continue to disclose security vulnerabilities in accordance with the
published Security Vulnerability Policy.
Affected Products
=================
The vulnerabilities disclosed in this advisory affect the Cisco
WRF players. The Microsoft Windows, Apple Mac OS X, and Linux
versions of the players are all affected. Review the following
table for the list of releases that contain the nonvulnerable
code. Affected versions of the players are those prior to client
build T26 SP49 EP40 and T27 SP28. These build numbers are
available only to WebEx site administrators. End users will see a
version such as "Client build: 27.25.4.11889." This indicates the
server is running software version T27 SP25 EP4.
To determine whether a Cisco WebEx meeting site is running an
affected version of the WebEx client build, users can log in to
their Cisco WebEx meeting site and go to the Support > Downloads
section. The version of the WebEx client build will be displayed
on the right side of the page under "About Support Center." See
"Software Versions and Fixes" for details.
Cisco recommends that users upgrade to the most current version
of the player that is available from www.webex.com/
downloadplayer.html. If the player is no longer needed, it can be
removed using the "Mac Cisco-WebEx Uninstaller" or "Meeting
Services Removal tool" available at support.webex.com/support/
downloads.html.
Users can manually verify the installed version of the WRF player
to determine whether it is affected by these vulnerabilities. To
do so, an administrator must examine the version numbers of the
installed files and determine whether the version of the file
contains the fixed code. Detailed instructions on how to verify
the version numbers are provided in the following sections.
The following tables provide the first nonvulnerable version of
each object.
Microsoft Windows
+----------------
Two dynamically linked libraries (DLLs) were updated on the
Microsoft Windows platform to address the vulnerabilities that
are described in this advisory. These files are in the folder C:\
Program Files\WebEx\Record Playback or C:\Program Files (x86)\
Webex\Record Player. The version number of a DLL can be obtained
by browsing the Record Playback directory in Windows Explorer,
right-clicking on the file name, and choosing Properties. The
Version or Details tab of the Properties page provides details on
the library version. The following table gives the first fixed
version number for each DLL. If the installed versions are equal
to or greater than the versions provided in the table, the system
is not vulnerable.
+----------------------------------------------------------------------------+
| Library | T26 SP49 | T27 SP11 | T27 SP21 | T27 SP25 | T27 SP28 |
| | EP40 | EP26 | EP9 | EP3 | |
|--------------+-------------+------------+----------+----------+------------|
| atas32.dll | Not | 2.6.11.0 | 2.6.21.5 | 2.6.25.0 | 2.6.28.0 |
| | vulnerable | | | | |
|--------------+-------------+------------+----------+----------+------------|
| atdl2006.dll | 2.5.49.4000 | 2.6.1123.1 | 2.6.21.1 | 2.6.20.0 | Not |
| | | | | | vulnerable |
+----------------------------------------------------------------------------+
Mac
+--
A package bundle was updated on the Macintosh platform to
address the vulnerabilities that are described in this advisory.
This file is in each user's home directory, which can be accessed
in ~/Library/Application Support/WebEx Folder/824 for systems
connected to servers running T26 and ~/Library/Application
Support/WebEx Folder/924 for systems connected to servers running
T27. The version can be obtained by browsing to the appropriate
folder in Finder and control-clicking the filename. When the menu
is displayed, select show package contents and then double-click
the Info.plist file. The version number is shown at the bottom of
the displayed table.
+-------------------------------------------------------------------------------+
| Bundle | T26 SP49 | T27 SP11 | T27 SP21 | T27 SP25 | T27 SP28
|
| | EP40 | EP26 | EP9 | EP3 |
|
|-------------------+-----------+------------+-----------+----------+------------|
| asplayback.bundle | 6.0.49.40 | 6.10.11.25 | 6.10.21.9 | 6.0.25.3 |
5.25.27.28 |
+-------------------------------------------------------------------------------+
Linux
A shared object was updated on the Linux platform to address the
vulnerabilities that are described in this advisory. This file is
in the ~/.webex directory. The version number of the shared
object can be obtained by performing a directory listing with the
ls command. The version number is provided after the .so
extension.
+---------------------------------------------------------------------------+
| Shared | T26 SP49 | T27 SP11 | T27 SP21 | T27 SP25 | T27 SP28 |
| Object | EP40 | EP26 | EP9 | EP3 | |
|------------+-----------+------------+-----------+------------+------------|
| atascli.so | 1.0.26.41 | 1.11.27.15 | 1.0.27.17 | 1.25.27.17 | 1.28.27.17 |
+---------------------------------------------------------------------------+
Vulnerable Products
+------------------
No other Cisco products are currently known to be affected by these
vulnerabilities.
Products Confirmed Not Vulnerable
+--------------------------------
The Cisco WebEx Player for the WebEx Advanced Recording Format (ARF)
file format is not affected by the vulnerabilities described in this
document.
No other Cisco products are currently known to be affected by these
vulnerabilities.
Details
=======
The WebEx meeting service is a hosted multimedia conferencing
solution that is managed and maintained by Cisco WebEx. The WRF file
format is used to store WebEx meeting recordings that have been
recorded on a WebEx meeting site or on the computer of an online
meeting attendee. The players are applications that are used to play
back and edit recording files (files with a .wrf extension). The WRF
players can be automatically installed when the user accesses a
recording file that is hosted on a WebEx meeting site (for stream
playback mode). The WRF players can also be manually installed after
downloading the application from www.webex.com/downloadplayer.html
to play back recording files locally (for offline playback mode).
The Cisco WebEx Recording Format (WRF) Player is affected by the
following vulnerabilities:
Cisco WebEx Player WRF Parsing Vulnerability
This vulnerability has been assigned the following Common
Vulnerabilities and Exposures (CVE) identifier: CVE-2011-3319
Cisco WebEx Player ATAS32 Processing Vulnerability
This vulnerability has been assigned the following Common
Vulnerabilities and Exposures (CVE) identifier: CVE-2011-4004
The vulnerabilities may cause the player application to crash or, in
some cases, remote code execution could occur.
To exploit one of these vulnerabilities, the player application would
need to open a malicious WRF file. An attacker may be able to
accomplish this exploit by providing the malicious recording file
directly to users (for example, by using e-mail) or by directing a
user to a malicious web page. The vulnerabilities cannot be triggered
by users who are attending a WebEx meeting.
Vulnerability Scoring Details
+----------------------------
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
* Multiple Cisco WebEx Player Buffer Overflow Vulnerabilities
CVSS Base Score - 9.3
Access Vector - Network
Access Complexity - Medium
Authentication - None
Confidentiality Impact - Complete
Integrity Impact - Complete
Availability Impact - Complete
CVSS Temporal Score - 7.7
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of the vulnerabilities described in this
document could cause the Cisco WRF player application to crash and,
in some cases, allow a remote attacker to execute arbitrary code on
the system with the privileges of the user who is running the WRF
player application.
Software Versions and Fixes
===========================
When considering software upgrades, also consult:
http://www.cisco.com/go/psirt and any subsequent advisories to
determine exposure and a complete upgrade solution.
These vulnerabilities are first fixed in the following versions:
* T26 SP49 EP40
* T27 FR20
* T27 SP11 EP23
* T27 SP21 EP9
* T27 SP23
* T27 SP25 EP3
* T27 SP28
The client build is listed in the Support > Downloads section of the
WebEx page after a user authenticates. WebEx bug fixes are cumulative
in a major release. For example, if release T27 SP22 EP9 is fixed,
release T27 SP22 EP23 will also have the software fix. End users
will see a version such as "Client build: 27.25.4.11889." This
indicates the server is running software version T27 SP25 EP4.
If a WRF player was automatically installed, it will be automatically
upgraded to the latest, nonvulnerable version when users access a
recording file that is hosted on a WebEx meeting site.
If a WRF player was manually installed, users will need to manually
install a new version of the player after downloading the latest
version from www.webex.com/downloadplayer.html. If the player is no
longer needed, it can be removed using the "Mac Cisco-WebEx
Uninstaller" or "Meeting Services Removal tool" available at
support.webex.com/support/downloads.html
Workarounds
===========
There are no workarounds for the vulnerabilities disclosed in this
advisory.
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at:
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
or as otherwise set forth at Cisco.com Downloads at:
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@xxxxxxxxx or security-alert@xxxxxxxxx for
software upgrades.
Customers with Service Contracts
+-------------------------------
This section does not apply for vulnerabilities in Cisco WebEx
products.
Customers using Third Party Support Organizations
+------------------------------------------------
This section does not apply for vulnerabilities in Cisco WebEx
products.
Customers without Service Contracts
+----------------------------------
This section does not apply for vulnerabilities in Cisco WebEx
products.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerabilities described in this advisory.
These vulnerabilities were reported to Cisco by TippingPoint. Cisco
would like to thank TippingPoint for reporting these vulnerabilities
to us.
Status of this Notice: Final
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111026-webex
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce@xxxxxxxxx
* first-teams@xxxxxxxxx
* bugtraq@xxxxxxxxxxxxxxxxx
* vulnwatch@xxxxxxxxxxxxx
* cisco@xxxxxxxxxxxxxxxxx
* cisco-nsp@xxxxxxxxxxxxxxx
* full-disclosure@xxxxxxxxxxxxxxxxx
* comp.dcom.sys.cisco@xxxxxxxxxxxxxxxxxx
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+-------------------------------------------------------------------+
| Revision 1.0 | 2011-October-26 | Initial public release |
+-------------------------------------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco
security notices.
All Cisco security advisories are available at:
http://www.cisco.com/go/psirt
+--------------------------------------------------------------------
Copyright 2010-2011 Cisco Systems, Inc. All rights reserved.
+--------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (SunOS)
iFcDBQFOqCUXQXnnBKKRMNARCO+aAP9IbHs1VnWKq0GY3UPgGavVWYYrypo9uR2g
S1eif/eNEQD7BRMCZrBRVyqMy2c0STwOH9IN35fyqGyLtlO/Nxv4geA=
=eg2S
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/