Vulnslist

find the latest Cisco vulnerabilities

Multiple Vulnerabilities in the Cisco WebEx Recording Format and Advanced Recording Format Players

cisco-sa-20140507-webex · Critical · Published · Updated

Multiple buffer overflow vulnerabilities exist in the Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players. Exploitation of these vulnerabilities could allow a remote attacker to cause an affected player to crash and, in some cases, could allow a remote attacker to execute arbitrary code on the system of a targeted user. The Cisco WebEx Players are applications that are used to play back WebEx meeting recordings that have been recorded on the computer of an online meeting attendee. The players can be automatically installed when the user accesses a recording file that is hosted on a WebEx server. Cisco has updated affected versions of the Cisco WebEx Business Suite meeting sites, Cisco WebEx 11 meeting sites, Cisco WebEx Meetings Server, and Cisco WebEx WRF and ARF Players to address these vulnerabilities. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140507-webex

Cisco advisory · CSAF JSON

Workarounds

While there are no workarounds for the vulnerabilities detailed in this advisory, it is possible to remove all WebEx software completely from a system using the Meeting Services Removal Tool (for Microsoft Windows users) or Mac Cisco-WebEx Uninstaller (for Apple Mac OS X users) available at http://support.webex.com/support/downloads.html["http://support.webex.com/support/downloads.html"]. 

Removal of WebEx software from a Linux or UNIX-based system can be accomplished by following the steps in the WebEx knowledge base help article at the following link: https://support.webex.com/MyAccountWeb/knowledgeBase.do?root=Tools&parent=Knowledge&articleId=WBX28548&txtSearchQuery=uninstall%20linux#["https://support.webex.com/MyAccountWeb/knowledgeBase.do?root=Tools&parent=Knowledge&articleId=WBX28548&txtSearchQuery=uninstall%20linux#"].

CVEsCVE-2014-2132, CVE-2014-2133, CVE-2014-2134, CVE-2014-2135, CVE-2014-2136
Cisco Bug IDsCSCuc39458, CSCuh52768, CSCui72223, CSCuj07603, CSCuj87565, CSCul01163, CSCul01166, CSCul87216
CVSS ScoreBase 9.3
Base 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C
Base 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C/E:POC/RL:OF/RC:C
Product Names From Source
Cisco WebEx WRF Player, Cisco WebEx ARF Player

Related Products

Product CVE Evidence
Cisco Webex Meetings CVE-2014-2136 Cisco OpenVuln
Cisco Webex Meetings CVE-2014-2135 Cisco OpenVuln
Cisco Webex Meetings CVE-2014-2134 Cisco OpenVuln
Cisco Webex Meetings CVE-2014-2133 Cisco OpenVuln
Cisco Webex Meetings CVE-2014-2132 Cisco OpenVuln
Cisco WebEx WRF Player CVE-2014-2136 Cisco OpenVuln
Cisco WebEx WRF Player CVE-2014-2135 Cisco OpenVuln
Cisco WebEx WRF Player CVE-2014-2134 Cisco OpenVuln
Cisco WebEx WRF Player CVE-2014-2133 Cisco OpenVuln
Cisco WebEx WRF Player CVE-2014-2132 Cisco OpenVuln
Cisco WebEx Meetings Server CVE-2014-2136 Cisco OpenVuln
Cisco WebEx Meetings Server CVE-2014-2135 Cisco OpenVuln
Cisco WebEx Meetings Server CVE-2014-2134 Cisco OpenVuln
Cisco WebEx Meetings Server CVE-2014-2133 Cisco OpenVuln
Cisco WebEx Meetings Server CVE-2014-2132 Cisco OpenVuln
Cisco WebEx ARF Player CVE-2014-2136 Cisco OpenVuln
Cisco WebEx ARF Player CVE-2014-2135 Cisco OpenVuln
Cisco WebEx ARF Player CVE-2014-2134 Cisco OpenVuln
Cisco WebEx ARF Player CVE-2014-2133 Cisco OpenVuln
Cisco WebEx ARF Player CVE-2014-2132 Cisco OpenVuln