full-disclosure - Cisco Security Advisory: Multiple Vulnerabilities in the Cisco WebEx Recording Format Player

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 10 Oct 2012 12:10:54 -0400
From: Cisco Systems Product Security Incident Response Team <psirt@...co.com>
To: full-disclosure@...ts.grok.org.uk
Cc: psirt@...co.com
Subject: Cisco Security Advisory: Multiple Vulnerabilities
	in the Cisco WebEx Recording Format Player

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Multiple Vulnerabilities in the Cisco WebEx Recording Format Player

Advisory ID: cisco-sa-20121010-webex

Revision 1.0

For Public Release 2012 October 10 16:00  UTC (GMT)
- ----------------------------------------------------------------------

Summary
=======

The Cisco WebEx Recording Format (WRF) player contains six buffer
overflow vulnerabilities. In some cases, exploitation of the
vulnerabilities could allow a remote attacker to execute arbitrary
code on the system with the privileges of a targeted user. 

The Cisco WebEx WRF Player is an application used to play back WRF
WebEx meeting recordings that have been recorded on a WebEx meeting
site or on the computer of an online meeting attendee. The Cisco WebEx
WRF Player can be automatically installed when the user accesses a
recording file that is hosted on a WebEx meeting site. The Cisco WebEx
WRF Player can also be manually installed for offline playback after
downloading the application from:
http://www.webex.com/play-webex-recording.html.

If the Cisco WebEx WRF Player was automatically installed, it will be
automatically upgraded to the latest, nonvulnerable version when users
access a recording file that is hosted on a WebEx meeting site. If the
Cisco WebEx WRF Player was manually installed, users will need to
manually install a new version of the Cisco WebEx WRF Player after
downloading the latest version from:
http://www.webex.com/play-webex-recording.html.

Cisco has updated affected versions of the WebEx meeting sites and
Cisco WebEx WRF Player to address these vulnerabilities. 

This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121010-webex

-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.18 (Darwin)
Comment: GPGTools - http://gpgtools.org

iF4EAREIAAYFAlB1h6AACgkQUddfH3/BbTrjWAD/Xo3bSaXFymHXWKgoGNJQTRcp
MFilgSgS+0Hp09ncDC0A/R+0E3BmJFwMukJw6IPAQkp+AjYus1naLVDcQMjh7svJ
=tuKg
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/