Would allow attackers to take control of affected systems

Sep 19, 2018 17:59 GMT  ·  By

Cisco released patches for multiple cross-platform vulnerabilities affecting the company's Webex Network Recording Player which would allow remote unauthenticated attackers to gain control of target systems.

The vulnerabilities have been found to affect the ARF recording players installed on Cisco Webex Meetings Online sites (up to 1.3.37), Cisco Webex Meetings Suite sites (up to WBS32.15.10/WBS33.3), and Cisco Webex Meetings Server (up to 3.0MR2).

According to Cisco's advisory, the vulnerabilities found to affect the Cisco Webex Network Recording Player for Advanced Recording Format (ARF) are due to improper validation of Webex recording files.

The vulnerabilities can be exploited by threat actors via hyperlinks and e-mail attachments leading to or containing a maliciously crafted file which would give the attackers control of the system once played using the Cisco Webex Player.

At least one of the vulnerabilities described in Cisco's advisories affect the Windows, macOS, and Linux versions of the Cisco Webex Network Recording Player.

Cisco has already released free updates for all vulnerabilities outlined in the advisory

Cisco says in their report that there are no workarounds to avoid having a system running the Cisco Webex Network Recording Player to be exploited, but system admins can mitigate the issue by uninstalling the player from the machine.

To remove the vulnerable Cisco Webex Network Recording Player from a system, you can use the Windows Meeting Services Removal Tool or the macOS Mac Webex Meeting Application Uninstaller available on the Cisco WebEx and 3rd Party Support Utilities help article.

Linux or UNIX users can protect unpatched systems by removing the player using the procedure described on the How Do I Uninstall WebEx Software on a Linux or Unix Based System? help page.

Cisco has already patched the vulnerability and released updates for the affected Cisco Webex Meetings Online sites, Cisco Webex Meetings Suite sites, or Cisco Webex Meetings Server.