CVE-2018-0104

A vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow a remote attacker to execute arbitrary code on the system of a targeted user. The attacker could exploit this vulnerability by sending the user a link or email attachment with a malicious ARF file and persuading the user to follow the link or launch the file. Successful exploitation could allow the attacker to execute arbitrary code on the user's system. This vulnerability affects Cisco WebEx Business Suite meeting sites, Cisco WebEx Meetings sites, Cisco WebEx Meetings Server, and Cisco WebEx ARF players. Cisco Bug IDs: CSCvg78853, CSCvg78856, CSCvg78857.

CVSS v3 9.6 CRITICAL
CVSS v2.0 9.3 HIGH

9.6^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Exploitability : 2.8 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.securityfocus.com/bid/102382	Third Party Advisory VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180103-warfp	Mitigation Vendor Advisory
http://www.securityfocus.com/bid/102382	Third Party Advisory VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180103-warfp	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:webex_business_suite:-:::::::*
	cpe:2.3:a:cisco:webex_meetings:-:::::::*
	cpe:2.3:a:cisco:webex_meetings_server:-:::::::*
	cpe:2.3:a:cisco:webex_network_recording_player:-:::::::*

History

No history.

Information

Published : 2018-01-04 06:29

Updated : 2024-11-21 03:37

NVD link : CVE-2018-0104

Mitre link : CVE-2018-0104

CVE.ORG link : CVE-2018-0104

JSON object : View

Products Affected

cisco

webex_meetings
webex_network_recording_player
webex_business_suite
webex_meetings_server

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2018-0104", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.8}]}, "published": "2018-01-04T06:29:00.387", "references": [{"url": "http://www.securityfocus.com/bid/102382", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180103-warfp", "tags": ["Mitigation", "Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securityfocus.com/bid/102382", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180103-warfp", "tags": ["Mitigation", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow a remote attacker to execute arbitrary code on the system of a targeted user. The attacker could exploit this vulnerability by sending the user a link or email attachment with a malicious ARF file and persuading the user to follow the link or launch the file. Successful exploitation could allow the attacker to execute arbitrary code on the user's system. This vulnerability affects Cisco WebEx Business Suite meeting sites, Cisco WebEx Meetings sites, Cisco WebEx Meetings Server, and Cisco WebEx ARF players. Cisco Bug IDs: CSCvg78853, CSCvg78856, CSCvg78857."}, {"lang": "es", "value": "Una vulnerabilidad en Cisco WebEx Network Recording Player para archivos Advanced Recording Format (.arf) podr\u00eda permitir que un atacante remoto ejecute c\u00f3digo arbitrario en el sistema de un usuario. El atacante podr\u00eda explotar esta vulnerabilidad enviando al usuario un enlace o archivo adjunto en un email con un archivo ARF malicioso y persuadiendo al usuario para que acceda al enlace o ejecute el archivo. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir que el atacante ejecute c\u00f3digo arbitrario en el sistema del usuario. Esta vulnerabilidad afecta a sitios de reuni\u00f3n Cisco WebEx Business Suite, Cisco WebEx Meetings, Cisco WebEx Meetings Server y a los reproductores Cisco WebEx ARF. Cisco Bug IDs: CSCvg78853, CSCvg78856, CSCvg78857."}], "lastModified": "2024-11-21T03:37:31.737", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:webex_business_suite:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7EC6601B-8E24-41E9-9716-6EDA9049839E"}, {"criteria": "cpe:2.3:a:cisco:webex_meetings:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81774C03-0884-44C6-80EF-DC882BF44C84"}, {"criteria": "cpe:2.3:a:cisco:webex_meetings_server:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9FE5F3F6-C7AE-4384-B58D-F0506719E35C"}, {"criteria": "cpe:2.3:a:cisco:webex_network_recording_player:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3AE7D641-CF31-48F6-AD29-4116EA7E7692"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}