Cisco Webex 多个高危误差清静通告

宣布时间 2019-01-25

误差编号和级别


CVE编号：CVE-2019-1637，危险级别：高危，CVSS分值：厂商自评：7.8，官方未评定CVE编号：CVE-2019-1638，危险级别：高危，CVSS分值：厂商自评：7.8，官方未评定CVE 编号：CVE-2019-1639，危险级别：高危，CVSS 分值：厂商自评：7.8，官方未评定


CVE 编号：CVE-2019-1640，危险级别：高危，CVSS 分值：厂商自评：7.8，官方未评定

CVE 编号：CVE-2019-1641，危险级别：高危，CVSS 分值：厂商自评：7.8，官方未评定


影响规模


受影响产品：

Cisco Webex Business Suite WBS32 sites — All Webex Network Recording Player and Webex Player versions prior to Version WBS32.15.33


Cisco Webex Business Suite WBS33 sites — All Webex Network Recording Player and Webex Player versions prior to Version WBS33.6.1 or WBS 33.7.0


Cisco Webex Meetings Online — All Webex Network Recording Player and Webex Player versions prior to Version 1.3.40


Cisco Webex Meetings Server — All Webex Network Recording Player versions prior to Version 2.8MR3 SecurityPatch1 or 3.0MR2 SecurityPatch2


误差概述


Cisco Webex Business Suite WBS32 sites等都是美国思科（Cisco）公司的视频聚会解决计划。Cisco Webex Network Recording Player和Webex Player都是其中的用于播放视频聚会纪录的播放器。


基于Windows平台的Cisco Webex Network Recording Player和Webex Player中保存的多个误差可能允许攻击者在受影响的系统上执行恣意代码。误差源于程序过失地验证了ARF和WRF文件。攻击者可通过链接或邮件附件发送恶意的ARF或WRF文件并诱使用户翻开该文件，使用该误差在受影响系统上执行恣意代码。


修复建议


现在厂商已宣布升级补丁以修复误差：https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-webex-rce.


Cisco Webex Business Suite WBS32 sites — Webex Network Recording Player and Webex Player Versions WBS32.15.33 and later


Cisco Webex Business Suite WBS33 sites — Webex Network Recording Player and Webex Player Versions WBS33.6.1 and later


Cisco Webex Meetings Online — Webex Network Recording Player and Webex Player Versions 1.3.40 and later


Cisco Webex Meetings Server — Webex Network Recording Player Versions 2.8MR3 SecurityPatch1 or 3.0MR2 SecurityPatch2 and later


尊龙凯时 - 人生就是搏!


参考链接


https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-webex-rce