Guest

Preview Tool

Cisco Bug: CSCvi10746 - Cisco WebEx Clients Remote Code Execution Vulnerability

Last Modified

Jul 10, 2018

Products (1)

  • Cisco Webex Meetings Server

Known Affected Releases

2.7 2.8 3.0

Description (partial)

Symptom:
A vulnerability in Cisco WebEx Business Suite clients, Cisco WebEx Meetings, and Cisco WebEx Meetings Server could allow an authenticated, remote attacker to execute arbitrary code on a targeted system.

The vulnerability is due to insufficient input validation by the Cisco WebEx clients. An attacker could exploit this vulnerability by providing meeting attendees with a malicious Flash (.swf) file via the file-sharing capabilities of the client. Exploitation of this vulnerability could allow arbitrary code execution on the system of a targeted user.

Conditions:
This vulnerability disclosed in this advisory affects the clients installed by customers when accessing a WebEx meeting. The following client builds of Cisco WebEx Business Suite (WBS30, WBS31, and WBS32), Cisco WebEx Meetings, and Cisco WebEx Meetings Server are impacted by the vulnerability described in this advisory:

* Cisco WebEx Business Suite (WBS31) client builds prior to T31.23.2
* Cisco WebEx Business Suite (WBS32) client builds prior to T32.10
* Cisco WebEx Meetings with client builds prior to T32.10
* Cisco WebEx Meetings Server builds prior to 2.8 MR2
Bug details contain sensitive information and therefore require a Cisco.com account to be viewed.

Bug Details Include

  • Full Description (including symptoms, conditions and workarounds)
  • Status
  • Severity
  • Known Fixed Releases
  • Related Community Discussions
  • Number of Related Support Cases
Bug information is viewable for customers and partners who have a service contract. Registered users can view up to 200 bugs per month without a service contract.