CVE-2018-0264 Code injection in Cisco WebEx Advanced Recording Format file players
Remote attackers can execute arbitrary code on user systems by tricking them into opening malicious ARF files in Cisco WebEx players.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2018-0264?
CVE-2018-0264 is a critical code injection vulnerability in Cisco Webex Meetings, published on 2 May 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability in the Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow an unauthenticated, remote attacker to execute arbitrary code on the system of a targeted user. An attacker could exploit this vulnerability by sending the user a link or email attachment with a malicious ARF file and persuading the user to follow the link or open the file. Successful exploitation could allow the attacker to execute arbitrary code on the user's system. This vulnerability affects Cisco WebEx Business Suite meeting sites, Cisco WebEx Meetings sites, Cisco WebEx Meetings Server, and Cisco WebEx ARF players. The following client builds of Cisco WebEx Business Suite (WBS31 and WBS32), Cisco WebEx Meetings, and Cisco WebEx Meetings Server are affected: Cisco WebEx Business Suite (WBS31) client builds prior to T31.23.4, Cisco WebEx Business Suite (WBS32) client builds prior to T32.12, Cisco WebEx Meetings with client builds prior to T32.12, Cisco WebEx Meeting Server builds prior to 3.0 Patch 1. Cisco Bug IDs: CSCvh85410, CSCvh85430, CSCvh85440, CSCvh85442, CSCvh85453, CSCvh85457.
Weakness: CWE-20
Which versions are affected by CVE-2018-0264?
It affects 4 products.
Products include Cisco Webex Business Suite 31, Cisco Webex Business Suite 32, Cisco Webex Meeting Server, Cisco Webex Meetings.
How do I fix CVE-2018-0264?
No fix has been published for CVE-2018-0264 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2018-0264 being exploited?
There is no known exploitation of CVE-2018-0264 in the wild and no public exploit code.
Other vulnerabilities in Cisco Webex Meetings
- CVE-2018-0112 Code injection in Cisco WebEx Clients
- CVE-2018-15409 Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities
- CVE-2018-15410 Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities
- CVE-2018-15418 Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities
- CVE-2018-0422 Privilege escalation in n/a
Sources
Also known as GHSA-qx7c-998c-pf6j.