DATABASE RESOURCES PRICING ABOUT US

{"id": "1337DAY-ID-19552", "type": "zdt", "bulletinFamily": "exploit", "title": "Cisco WebEx .wrf Memory Corruption", "description": "Exploit for hardware platform in category local exploits", "published": "2012-10-12T00:00:00", "modified": "2012-10-12T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://0day.today/exploit/description/19552", "reporter": "Core Security", "references": [], "cvelist": [], "immutableFields": [], "lastseen": "2018-04-09T01:49:57", "viewCount": 7, "enchantments": {"score": {"value": 0.1, "vector": "NONE"}, "dependencies": {}, "backreferences": {"references": [{"type": "coresecurity", "idList": ["CORE-2012-0613"]}, {"type": "cve", "idList": ["CVE-2012-3939"]}]}, "exploitation": null, "vulnersScore": 0.1}, "sourceHref": "https://0day.today/exploit/19552", "sourceData": "-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\nCore Security - Corelabs Advisory\r\nhttp://corelabs.coresecurity.com/\r\n\r\nCisco WebEx .wrf Memory Corruption Vulnerability\r\n\r\n\r\n\r\n1. *Advisory Information*\r\n\r\nTitle: Cisco WebEx .wrf Memory Corruption Vulnerability\r\nAdvisory ID: CORE-2012-0613\r\nAdvisory URL:\r\nhttp://www.coresecurity.com/content/webex-wrf-memory-corruption-vulnerability\r\nDate published: 2012-10-11\r\nDate of last update: 2012-09-13\r\nVendors contacted: Cisco\r\nRelease mode: Coordinated release\r\n\r\n\r\n\r\n2. *Vulnerability Information*\r\n\r\nClass: Access of Memory Location After End of Buffer [CWE-788]\r\nImpact: Code execution\r\nRemotely Exploitable: No\r\nLocally Exploitable: Yes\r\nCVE Name: CVE-2012-3939\r\n\r\n\r\n\r\n3. *Vulnerability Description*\r\n\r\nA vulnerability exists in atas32.dll affecting Cisco WebEx Player v3.26\r\nthat allows an attacker to corrupt memory, which may lead to code\r\nexecution in the context of the currently logged on user.\r\n\r\n\r\n4. *Vulnerable packages*\r\n\r\n . Cisco WebEx Player v3.26\r\n . Cisco Meeting Center and older versions of WebEx Player are\r\nprobably affected too, but they were not checked.\r\n\r\n\r\n5. *Vendor Information, Solutions and Workarounds*\r\n\r\nIf the Cisco WebEx WRF Player was automatically installed, it will be\r\nautomatically upgraded to the latest, nonvulnerable version when users\r\naccess a recording file that is hosted on a WebEx meeting site. A\r\nnon-vulnerable version of Cisco WebEx Player should be available at\r\nhttp://www.webex.com/downloadplayer.html.\r\n\r\n\r\n6. *Credits*\r\n\r\nThis vulnerability was discovered and researched by Oren Isacson. The\r\npublication of this advisory was coordinated by Fernando russ.\r\n\r\n\r\n7. *Technical Description / Proof of Concept*\r\n\r\nThe memory corruption is caused by a call to the memcpy function with an\r\ninvalid destination parameter.\r\n\r\nIn our proof of concept (POC), the destination parameter to the memcpy\r\nfunction points to unmapped memory. The source parameters points to\r\nvalid heap memory. The size parameter is equal to 540. As the\r\ndestination parameter is close to the top of the heap, and the source\r\nparameter points to data that may be user-controlled, this vulnerability\r\nmay be leveraged to execute code.\r\n\r\n\r\n8. *Report Timeline*\r\n\r\n. 2012-06-21:\r\nCore Security Technologies notifies Cisco Product Security Incident\r\nResponse Team of the vulnerability, including a brief description of the\r\nissue.\r\n\r\n. 2012-06-21:\r\nCisco PSIRT acknowledges the receipt of the information. Vendor asks for\r\ndetailed technical information.\r\n\r\n. 2012-06-21:\r\nCore sends a draft version of the advisory and a PoC .wrf file which\r\nreproduce the issue.\r\n\r\n. 2012-06-25:\r\nCisco PSIRT asks for more information regarding the exact version of the\r\natas32.dll libary version.\r\n\r\n. 2012-06-25:\r\nCore sends the requested information.\r\n\r\n. 2012-07-11:\r\nCore notifies that the tentative publication deadline was missed and\r\nreschedule the publication for August 6th, 2012.\r\n\r\n. 2012-07-12:\r\nCisco PSIRT asks if the advisory publication can be hold until they have\r\nfinished its fixes.\r\n\r\n. 2012-07-12:\r\nCore notifies that the current publication date is tentative and can be\r\nmoved while the new publication date keeps reasonable.\r\n\r\n. 2012-07-16:\r\nCisco PSIRT informs that they can't be sure of having fixes sooner that\r\nbeginning of September.\r\n\r\n. 2012-07-17:\r\nCore acknowledges the new timeframe for the publication and asks for a\r\nmore specific date.\r\n\r\n. 2012-07-20:\r\nCisco PSIRT informs that the new publication date for the fixes and all\r\nthe related information regarding this vulnerability is September 12th,\r\n2012.\r\n\r\n. 2012-07-23:\r\nCore Security Technologies acknowledges the new deadline for the\r\npublication.\r\n\r\n. 2012-08-23:\r\nCisco PSIRT asks to postpone the publication date to October 10th, 2012.\r\n\r\n. 2012-08-27:\r\nCore acknowledges the new deadline for the publication.\r\n\r\n. 2012-09-12:\r\nPublication date confirmed on [2012-07-20] missed.\r\n\r\n. 2012-10-11:\r\nAdvisory CORE-2012-0613 published.\r\n\r\n\r\n\r\n9. *About CoreLabs*\r\n\r\nCoreLabs, the research center of Core Security Technologies, is charged\r\nwith anticipating the future needs and requirements for information\r\nsecurity technologies. We conduct our research in several important\r\nareas of computer security including system vulnerabilities, cyber\r\nattack planning and simulation, source code auditing, and cryptography.\r\nOur results include problem formalization, identification of\r\nvulnerabilities, novel solutions and prototypes for new technologies.\r\nCoreLabs regularly publishes security advisories, technical papers,\r\nproject information and shared software tools for public use at:\r\nhttp://corelabs.coresecurity.com.\r\n\r\n\r\n10. *About Core Security Technologies*\r\n\r\nCore Security Technologies enables organizations to get ahead of threats\r\nwith security test and measurement solutions that continuously identify\r\nand demonstrate real-world exposures to their most critical assets. Our\r\ncustomers can gain real visibility into their security standing, real\r\nvalidation of their security controls, and real metrics to more\r\neffectively secure their organizations.\r\n\r\nCore Security's software solutions build on over a decade of trusted\r\nresearch and leading-edge threat expertise from the company's Security\r\nConsulting Services, CoreLabs and Engineering groups. Core Security\r\nTechnologies can be reached at +1 (617) 399-6980 or on the Web at:\r\nhttp://www.coresecurity.com.\r\n\r\n\r\n11. *Disclaimer*\r\n\r\nThe contents of this advisory are copyright (c) 2012 Core Security\r\nTechnologies and (c) 2012 CoreLabs, and are licensed under a Creative\r\nCommons Attribution Non-Commercial Share-Alike 3.0 (United States)\r\nLicense: http://creativecommons.org/licenses/by-nc-sa/3.0/us/\r\n\r\n\r\n12. *PGP/GPG Keys*\r\n\r\nThis advisory has been signed with the GPG key of Core Security\r\nTechnologies advisories team, which is available for download at\r\nhttp://www.coresecurity.com/files/attachments/core_security_advisories.asc.\r\n\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1.4.12 (Darwin)\r\nComment: Using GnuPG with Mozilla - http://www.enigmail.net/\r\n\r\niQEcBAEBAgAGBQJQdyjEAAoJEK6bq3WCdh+HiPEH+wVJOMXbci4VXZjJLKuabrM8\r\nsm2l7wdUx7ebPxm5wG05ns+9joRjtiXxXVSZWrpWtrKcTHlPWYm8iPYbnGGOi9vs\r\nNpFz+fMSncT/MIFhQBePJQkcPhEeqVEtdVc+DCXv+WfQ6MNxpbGhLj7O1mXxJOUN\r\n5aes2i8iBVxdzEPydVApG+Fz0YDeonlh7djEKwyUZCzHJlb7ZOUiKtaXLrWM7PLc\r\n+xzMLCaBzm+srm7mo/71nD7/OKcAfR14m8gixxPkjmdWjf831Sd5yeAzZF/o3bAG\r\nRTMsZ2WKNmYqWL+KbdMTmYhF0G2eM0jYmpdkXc7zUhb85GuHJD3PDAQGTjAZkjQ=\r\n=9sT3\r\n-----END PGP SIGNATURE-----\r\n\r\n\n\n# 0day.today [2018-04-09] #", "_state": {"dependencies": 1645424955, "score": 1659766679, "epss": 1678811959}}

{}