Multiple Vulnerabilities in the Cisco WebEx Recording Format Player

2012-10-10T16:00:00
ID CISCO-SA-20121010-WEBEX
Type cisco
Reporter Cisco
Modified 2012-10-10T14:04:59

Description

The Cisco WebEx Recording Format (WRF) player contains a buffer overflow vulnerability that could allow a remote attackers to cause a denial of service or execute arbitrary code with the privilege of the logged in user. An attacker can exploit this vulnerability by enticing a user to play a crafted WRF file with a vulnerable player.

The Cisco WebEx Recording Format (WRF) player contains a heap based buffer overflow vulnerability that could allow a remote attackers to cause a denial of service or execute arbitrary code with the privilege of the logged in user. An attacker can exploit this vulnerability by enticing a user to play a crafted WRF file with a vulnerable player.

The Cisco WebEx Recording Format (WRF) player contains a memory corruption vulnerability that could allow a remote attackers to cause a denial of service or execute arbitrary code with the privilege of the logged in user. An attacker can exploit this vulnerability by enticing a user to play a crafted WRF file with a vulnerable player.

The Cisco WebEx Recording Format (WRF) player contains six buffer overflow vulnerabilities. In some cases, exploitation of the vulnerabilities could allow a remote attacker to execute arbitrary code on the system with the privileges of a targeted user.

The Cisco WebEx WRF Player is an application used to play back WRF WebEx meeting recordings that have been recorded on a WebEx meeting site or on the computer of an online meeting attendee. The Cisco WebEx WRF Player can be automatically installed when the user accesses a recording file that is hosted on a WebEx meeting site. The Cisco WebEx WRF Player can also be manually installed for offline playback after downloading the application from http://www.webex.com/play-webex-recording.html["http://www.webex.com/play-webex-recording.html"].

If the Cisco WebEx WRF Player was automatically installed, it will be automatically upgraded to the latest, nonvulnerable version when users access a recording file that is hosted on a WebEx meeting site. If the Cisco WebEx WRF Player was manually installed, users will need to manually install a new version of the Cisco WebEx WRF Player after downloading the latest version from http://www.webex.com/play-webex-recording.html["http://www.webex.com/play-webex-recording.html"].

Cisco has updated affected versions of the WebEx meeting sites and Cisco WebEx WRF Player to address these vulnerabilities.

This advisory is available at the following link:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121010-webex["http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121010-webex"]