CVE-2016-6447 Memory corruption in Cisco Meeting Server before 2.0.1, Acano Server before 1.9.3, Cisco Meeting App before 1.9.8, Acano Meeting Apps before 1.8.35
Unauthenticated remote attackers can execute arbitrary code on Cisco Meeting Server and Meeting App systems due to a memory corruption vulnerability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-6447?
CVE-2016-6447 is a critical memory corruption vulnerability in Cisco Meeting Server before 2.0.1, Acano Server before 1.9.3, Cisco Meeting App before 1.9.8, Acano Meeting Apps before 1.8.35, published on 3 Nov 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in Cisco Meeting Server and Meeting App could allow an unauthenticated, remote attacker to execute arbitrary code on an affected system. This vulnerability affects the following products: Cisco Meeting Server releases prior to 2.0.1, Acano Server releases prior to 1.8.16 and prior to 1.9.3, Cisco Meeting App releases prior to 1.9.8, Acano Meeting Apps releases prior to 1.8.35. More Information: CSCva75942 CSCvb67878. Known Affected Releases: 1.81.92.0.
Weakness: CWE-119
Which versions are affected by CVE-2016-6447?
It affects 2 products.
Products include Cisco Meeting App, Cisco Meeting Server.
How do I fix CVE-2016-6447?
No fix has been published for CVE-2016-6447 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2016-6447 being exploited?
There is no known exploitation of CVE-2016-6447 in the wild and no public exploit code.
Other vulnerabilities in Cisco Meeting Server before 2.0.1, Acano Server before 1.9.3, Cisco Meeting App before 1.9.8, Acano Meeting Apps before 1.8.35
Sources
Also known as GHSA-54fq-cr2j-w2qc.