Security News Critical Cisco WebEx Bug Allows Remote Code Execution

[LASER_oneXM]

Content source

https://threatpost.com/critical-cisco-webex-bug-allows-remote-code-execution/131657/

A critical vulnerability in the recording function of Cisco Systems’ WebEx conferencing platform has been uncovered, allowing for remote code execution. Attackers can use the flaw by convincing users to open a file purporting to be a recording of a past WebEx event.


The bug (CVE-2018-0264) exists in the platform’s Recording Player for Advanced Recording Format (ARF), which allows users to play back WebEx meeting recordings. The player is installed automatically when a user accesses a recording file hosted on a WebEx server. Cisco WebEx Business Suite meeting sites, Cisco WebEx Meetings sites, the Cisco WebEx Meetings Server and the Cisco WebEx ARF Player itself are all affected.

WebEx is widely deployed, and is used for audio and web conferencing along with broadcast applications like webinars and corporate C-suite speeches. Cisco said in an advisory that attackers can take advantage of this large attack surface via social engineering and spam campaigns, with the aim of convincing users to open a malicious ARF file.


Given how many businesses use WebEx, and how many workers attend WebEx meetings and events, it’s easily conceivable that an email using a lure along the lines of “Thanks for attending our webinar. Follow the link to access the event on-demand” could be spectacularly effective.

If clicked, the file opens the door to executing arbitrary code on the user’s system.

There are no workarounds that address the problem, but it’s possible to remove all WebEx software completely from a system by using a specialized tool created by Cisco. The IT giant has also made a patch available for the affected products.

 

[Deleted member 65228]

Yikes!

Anyway, it still requires user-intervention to open a file so at-least it isn't even less user-interaction dependent. On the bright side, Cisco have released patches.

Social engineering is a very important weakness to investigate though. You can never full-proof against it, but you can harden yourself to catch out social engineering attempts before any harm is done and distance yourself from being a target.