Cisco Security Advisory
Click Icon to Copy Verbose Score
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:X/RL:X/RC:X
-
A vulnerability in the folder permissions of Cisco Webex Meetings client for Windows could allow an authenticated, local attacker to modify locally stored files and execute code on a targeted device with the privilege level of the user.
The vulnerability is due to folder permissions that grant a user the permission to read, write, and execute files in the Webex folders. An attacker could exploit this vulnerability to write malicious files to the Webex client directory, affecting all other users of the targeted device. A successful exploit could allow a user to execute commands with elevated privileges.
Attacks on single-user systems are less likely to occur, as the attack must be carried out by the user on the user's own system. Multiuser systems have a higher risk of exploitation because folder permissions have an impact on all users of the device. For an attacker to exploit this vulnerability successfully, a second user must execute the locally installed malicious file to allow remote code execution to occur.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-webex-pe
-
Vulnerable Products
This vulnerability affects client applications installed from the following Cisco Webex Meetings products when running on Microsoft Windows end-user systems:
- Cisco Webex Meetings Suite (WBS31)
- Cisco Webex Meetings Suite (WBS32)
- Cisco Webex Meetings Suite (WBS33)
- Cisco Webex Meetings
- Cisco Webex Meetings Server
To determine whether a Cisco Webex meeting site is running an affected version of the Webex software, users can log in to their Cisco Webex meeting site and go to Support > Downloads. The version of the Webex software will be displayed on the right side of the page under About Meeting Center. See the Fixed Software section of this advisory for details.
Alternatively, version information for the Cisco Webex meeting client can be accessed directly in the client. Version information for the Cisco Webex meeting client on Windows platforms can be viewed by choosing Help > About Cisco Webex Meeting Center.
Note: Customers who do not receive automatic software updates may be running versions of Cisco Webex Meetings that have reached end of software maintenance and should contact the Cisco TAC (Technical Assistance Center).
Products Confirmed Not Vulnerable
Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.
Cisco has confirmed that this vulnerability does not affect Cisco Webex Meetings client applications running on Mac OS X and Linux operating systems.
-
Cisco will release free software updates that address the vulnerability described in this advisory. Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license:
https://www.cisco.com/c/en/us/products/end-user-license-agreement.htmlAdditionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades.
When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories and Alerts page, to determine exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
Customers Without Service Contracts
Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC:
https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.htmlCustomers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.
Fixed Releases
Cisco has released new desktop applications to remediate this vulnerability. Users must have the new desktop applications installed to remediate the vulnerability.
Users can obtain the installable MSI from their upgraded site. For WBS33, the applications are automatically delivered and installed automatically when administrative users attend a meeting on a WBS33 site.
Users without administrative rights will not be able to install the update automatically and will require administrators to install the application installable MSI on their desktops.
Due to customers’ lock down status of WBS 32, users or IT administrators must install the desktop applications manually.
Users or IT administrators can contact the Cisco TAC to obtain the desktop applications’ installable MSI prior to their site’s upgrade.
Customers’ sites are being upgraded to make this desktop application available to users according to the following schedule:
Webex Major Release
First Fixed Release
Availability
Cisco Webex Meetings Suite (WBS31)
N/A
Cisco will not release a new desktop application for WBS31 releases. Customers must upgrade to WBS32 or WBS33 and install the appropriate update.
Cisco Webex Meetings Suite (WBS32)
WBS32.15.20
Released
See WBS 32.15.20 availability on your site based on your cluster schedule: https://status.webex.com/#/maintenance/calendar
End users or IT administrators must install new desktop applications manually to remediate the vulnerability.
Contact the Cisco TAC to obtain desktop applications’ installable MSI prior to availability on your site.
Cisco Webex Meetings Suite (WBS33)
WBS33.4
Released
See WBS33.4 availability on your site based on your cluster schedule: https://status.webex.com/#/maintenance/calendar
Users with administrative rights on their desktops will automatically receive a Windows User Account Control (UAC) pop-up window after they join or start a meeting on an updated WBS33.4 site. Users must accept this UAC request to remediate the vulnerability.
Users without administrative rights will not be able to install the update automatically and will require administrators to install the application installable MSI on their desktops.
Contact the Cisco TAC to obtain the desktop applications’ installable MSI prior to availability on your site.
Note that the WBS33.4 installable MSI installs the new Webex Desktop application, which includes the new Outlook plug-in and replaces the older Productivity Tools. Although replacement of Productivity Tools with the new desktop application is highly recommended, please contact the Cisco TAC if this replacement is not desired.
Cisco Webex Meetings
1.3.37
Available beginning September 14, 2018
Contact the Cisco TAC to obtain the desktop applications’ installable MSI prior to availability on the site.
Cisco Webex Meetings Server
3.0MR2
Released
The software is available for download from the Software Center on Cisco.com by clicking Browse all and navigating to Conferencing > Web Conferencing > Webex Meetings Server > Webex Meetings Server 3.0 or via direct link.
Fixed software will be available on customers’ sites based on the release update schedule. Customers will receive a separate communication with the update schedule for their site. Customers can also contact the Cisco TAC to determine their site’s update schedule.
To determine whether a meeting site has an updated version of the Cisco Webex software, users can sign in to their Cisco Webex Meetings site and go to the Support > Downloads section. The version is displayed on the right side of the page under About Webex Meetings.
-
The Cisco Product Security Incident Response Team (PSIRT) is aware of public announcements of the vulnerability. However, there has been no indication of malicious use of the vulnerability that is described in this advisory.
-
Cisco would like to thank Simon Zuckerbraun, working with Trend Micro's Zero Day Initiative (ZDI), for reporting this vulnerability.
Cisco would also like to thank Ben Cheney of DXC Technology and Ron Bowes and Jeff McJunkin of Counter Hack for independently reporting this vulnerability.
-
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
-
Show LessVersion Description Section Status Date 1.1 Added Cisco bug CSCvk70822. Cited additional sources. Cisco Bug IDs and Source Final 2018-September-26 1.0 Initial public release. — Final 2018-September-05
-
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.