Cisco WebEx Error Message Information Disclosure Vulnerability

2013-08-02T19:32:47
ID CISCO-SA-20130802-CVE-2013-3425
Type cisco
Reporter Cisco
Modified 2013-08-02T19:32:40

Description

A vulnerability in Cisco WebEx could allow an authenticated, remote attacker to access sensitive information.

The vulnerability is due to improper error messages displayed by the affected software when handling requests to view another user's files. An attacker could exploit this vulnerability by submitting crafted security parameter index (SPI) calls to the affected software. Successful exploitation could allow attackers to determine the existence of files they are not authorized to access. This information could be used to launch additional attacks.

Cisco has confirmed this vulnerability in a security notice and released software updates.

To exploit this vulnerability, an attacker must authenticate to a targeted device. This access requirement decreases the likelihood of a successful exploit.

Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.

Cisco WebEx Version 11 contains a vulnerability that could allow an authenticated, remote attacker to determine if a file exists.

The vulnerability is due to different error messages when a file exists but the user lacks privileges and when the file does not exist. An attacker could exploit this vulnerability by attempting to view other users files through crafted SPI calls. An exploit could allow the attacker to determine whether a file exists.