Cisco Security Advisory
Buffer Overflow Vulnerabilities in the Cisco WebEx Player
-
The Cisco WebEx Recording Format (WRF) player contains three buffer overflow vulnerabilities. In some cases, exploitation of the vulnerabilities could allow a remote attacker to execute arbitrary code on the system with the privileges of a targeted user.
The Cisco WebEx Players are applications that are used to play back WebEx meeting recordings that have been recorded on a WebEx meeting site or on the computer of an online meeting attendee. The players can be automatically installed when the user accesses a recording file that is hosted on a WebEx meeting site. The players can also be manually installed for offline playback after downloading the application from www.webex.com.
If the WRF player was automatically installed, it will be automatically upgraded to the latest, nonvulnerable version when users access a recording file that is hosted on a WebEx meeting site. If the WRF player was manually installed, users will need to manually install a new version of the player after downloading the latest version from www.webex.com.
Cisco has updated affected versions of the WebEx meeting sites and WRF player to address these vulnerabilities.This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120404-webex
-
Vulnerable Products
The vulnerabilities disclosed in this advisory affect the Cisco WebEx Recording Format (WRF) player. The following client builds of Cisco WebEx Business Suite (WBS 27) are affected by at least one of the vulnerabilities that are described in this advisory:
- Client builds 27.32.0 (T27 LD SP32) and prior
- Client builds 27.25.9 (T27 LC SP25 EP9) and prior
- Client builds 27.21.10 (T27 LB SP21 EP10) and prior
- Client builds 27.11.26 (T27 L SP11 EP26) and prior
Note: Customers who do not receive automatic software updates may be running versions of Cisco WebEx that have reached end of software maintenance.
Products Confirmed Not Vulnerable
No other Cisco products are currently known to be affected by these vulnerabilities.
WBS 28 is not affected by the vulnerabilities described in this advisory.
-
The WebEx meeting service is a hosted multimedia conferencing solution that is managed and maintained by Cisco WebEx. The WRF file format is used to store WebEx meeting recordings that have been recorded on a WebEx meeting site or on the computer of an online meeting attendee. The players are applications that are used to play back and edit recording files, which use the .wrf extension. The WRF players can be automatically installed when the user accesses a recording file that is hosted on a WebEx meeting site (for stream playback mode). The WRF player can also be manually installed after downloading the application from http://www.webex.com/play-webex-recording.html to play back recording files locally (for offline playback mode).
The following Common Vulnerabilities and Exposures (CVE) identifiers have been assigned for the buffer overflows in this advisory:- CVE-2012-1335
- CVE-2012-1336
- CVE-2012-1337
Exploitation of the vulnerabilities may cause the player application to crash or, in some cases, result in remote code execution.
To exploit one of these vulnerabilities, the player application must open a malicious WRF file. An attacker may be able to accomplish this exploit by providing the malicious recording file directly to users (for example, by using e-mail) or by directing a user to a malicious web page. The vulnerabilities cannot be triggered by users who are attending a WebEx meeting.
-
There are no workarounds for the vulnerabilities described in this document.
-
When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance.
The following client builds of Cisco WebEx Business Suite (WBS27) correct the vulnerabilities described in this advisory:
- Client builds 27.25.10 (T27 LC SP25 EP10)
- Client builds 27.32.1 (T27 LD SP32 CP1)
Client builds prior to T27 SP25 have reached end of support; in order to obtain fixed software please upgrade to the latest version.
To determine the WebEx client build, users can log in to their Cisco WebEx meeting site and navigate to the Support > Downloads section. The version of the WebEx client build will be displayed on the right side of the page. Cisco WebEx software updates are cumulative in client builds. For example, if client build 27.25.10 is fixed, build 27.25.11 will also contain the software update.
The Microsoft Windows, Apple Mac OS X, and Linux versions of the Cisco WRF players are all affected. If a player was automatically installed, it will be automatically upgraded to the latest, nonvulnerable version when users access a recording file that is hosted on a WebEx meeting site. If a Cisco WebEx recording player was manually installed, users must download the latest version from http://www.webex.com/play-webex-recording.html and install it. To remove the players completely, access the Meeting Services Removal Tool or Mac Cisco-WebEx Uninstaller (for Apple Mac users) at http://support.webex.com/support/downloads.html.
Users can determine whether a player is affected by these vulnerabilities by manually verifying the installed version. To do so, users can examine the file version and determine whether it contains the fixed code.
Microsoft Windows
One dynamic link library (DLL) was updated on the Microsoft Windows platform to address the vulnerabilities that are described in this advisory. These files are located in the C:\Program Files\WebEx\Record Playback folder or the C:\Program Files (x86)\Webex\Record Player folder. The version number of a DLL can be obtained by browsing the Record Playback directory in Windows Explorer, right-clicking the filename, and choosing Properties. The Version or Details tab of the Properties page provides details on the library version. The following table provides the first fixed version for the DLL atas32.dll. If the installed versions are equal to or greater than the versions provided in the table, the system is not vulnerable.
Client Build Cisco WRF DLL Filename DLL File Version 27.25.10 atas32.dll 2.6.25.1 27.25.10 atdl2006.dll 1027.1125.1206.1310 27.32.1 atas32.dll 2.6.32.2 Apple Mac
Three package bundles were updated on the Apple Mac OS platform to address the vulnerabilities that are described in this advisory. This file is located in each user's home directory and can be accessed from ~/Library/Application Support/WebEx Folder/924. The version can be obtained by browsing to the appropriate folder in Finder and control-clicking the filename. When the menu is displayed, choose show package contents and then double-click the Info.plist file. The version number is shown at the bottom of the displayed table. The following table provides the first fixed version for each package bundle. If the installed versions are equal to or greater than the versions provided in the table, the system is not vulnerable.
Client Build
Cisco WRF Bundle Filename
Bundle File Versions
27.25.10 atas.bundle 12.15.25.3 27.32.1 atas.bundle 12.13.32.0 27.32.1 asplayback.bundle 12.13.32.0 27.32.1 as.bundle 12.13.32.0 Linux
Three shared objects were updated on the Linux platform to address the vulnerabilities that are described in this advisory. These files are located in the ~/.webex directory. The version number of the shared objects can be obtained by performing a directory listing with the ls command. The version number is provided after the .so extension. The following table provides the first fixed version for each shared object. If the installed versions are equal to or greater than the versions provided in the table, the system is not vulnerable.
Client Build
Cisco WRF Shared Object Filename
Shared Object File Versions
27.32.1 libnbrascli.so 1.29.27.23 27.32.1 atjpeg.so 1.0.27.2 27.25.10 atjpeg.so 1.0.27.2
-
The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
This vulnerability was reported to Cisco by Secunia and iDefense.
-
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
-
Show LessRevision 1.1 2012-July-18 Updated advisory metatags. Revision 1.0 2012-April-04 Initial public release.
-
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A stand-alone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy, and may lack important information or contain factual errors. The information in this document is intended for end-users of Cisco products.