what you don't know can hurt you

Cisco WebEx .wrf Memory Corruption

Cisco WebEx .wrf Memory Corruption
Posted Oct 13, 2012
Authored by Core Security Technologies, Oren Isacson | Site coresecurity.com

Core Security Technologies Advisory - A vulnerability exists in atas32.dll affecting Cisco WebEx Player version 3.26 that allows an attacker to corrupt memory, which may lead to code execution in the context of the currently logged on user.

tags | advisory, code execution
systems | cisco
advisories | CVE-2012-3939
MD5 | 192389230e391850df82e6a9271aa811

Cisco WebEx .wrf Memory Corruption

Change Mirror Download

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Core Security - Corelabs Advisory
http://corelabs.coresecurity.com/

Cisco WebEx .wrf Memory Corruption Vulnerability



1. *Advisory Information*

Title: Cisco WebEx .wrf Memory Corruption Vulnerability
Advisory ID: CORE-2012-0613
Advisory URL:
http://www.coresecurity.com/content/webex-wrf-memory-corruption-vulnerability
Date published: 2012-10-11
Date of last update: 2012-09-13
Vendors contacted: Cisco
Release mode: Coordinated release



2. *Vulnerability Information*

Class: Access of Memory Location After End of Buffer [CWE-788]
Impact: Code execution
Remotely Exploitable: No
Locally Exploitable: Yes
CVE Name: CVE-2012-3939



3. *Vulnerability Description*

A vulnerability exists in atas32.dll affecting Cisco WebEx Player v3.26
that allows an attacker to corrupt memory, which may lead to code
execution in the context of the currently logged on user.


4. *Vulnerable packages*

. Cisco WebEx Player v3.26
. Cisco Meeting Center and older versions of WebEx Player are
probably affected too, but they were not checked.


5. *Vendor Information, Solutions and Workarounds*

If the Cisco WebEx WRF Player was automatically installed, it will be
automatically upgraded to the latest, nonvulnerable version when users
access a recording file that is hosted on a WebEx meeting site. A
non-vulnerable version of Cisco WebEx Player should be available at
http://www.webex.com/downloadplayer.html.


6. *Credits*

This vulnerability was discovered and researched by Oren Isacson. The
publication of this advisory was coordinated by Fernando russ.


7. *Technical Description / Proof of Concept*

The memory corruption is caused by a call to the memcpy function with an
invalid destination parameter.

In our proof of concept (POC), the destination parameter to the memcpy
function points to unmapped memory. The source parameters points to
valid heap memory. The size parameter is equal to 540. As the
destination parameter is close to the top of the heap, and the source
parameter points to data that may be user-controlled, this vulnerability
may be leveraged to execute code.


8. *Report Timeline*

. 2012-06-21:
Core Security Technologies notifies Cisco Product Security Incident
Response Team of the vulnerability, including a brief description of the
issue.

. 2012-06-21:
Cisco PSIRT acknowledges the receipt of the information. Vendor asks for
detailed technical information.

. 2012-06-21:
Core sends a draft version of the advisory and a PoC .wrf file which
reproduce the issue.

. 2012-06-25:
Cisco PSIRT asks for more information regarding the exact version of the
atas32.dll libary version.

. 2012-06-25:
Core sends the requested information.

. 2012-07-11:
Core notifies that the tentative publication deadline was missed and
reschedule the publication for August 6th, 2012.

. 2012-07-12:
Cisco PSIRT asks if the advisory publication can be hold until they have
finished its fixes.

. 2012-07-12:
Core notifies that the current publication date is tentative and can be
moved while the new publication date keeps reasonable.

. 2012-07-16:
Cisco PSIRT informs that they can't be sure of having fixes sooner that
beginning of September.

. 2012-07-17:
Core acknowledges the new timeframe for the publication and asks for a
more specific date.

. 2012-07-20:
Cisco PSIRT informs that the new publication date for the fixes and all
the related information regarding this vulnerability is September 12th,
2012.

. 2012-07-23:
Core Security Technologies acknowledges the new deadline for the
publication.

. 2012-08-23:
Cisco PSIRT asks to postpone the publication date to October 10th, 2012.

. 2012-08-27:
Core acknowledges the new deadline for the publication.

. 2012-09-12:
Publication date confirmed on [2012-07-20] missed.

. 2012-10-11:
Advisory CORE-2012-0613 published.



9. *About CoreLabs*

CoreLabs, the research center of Core Security Technologies, is charged
with anticipating the future needs and requirements for information
security technologies. We conduct our research in several important
areas of computer security including system vulnerabilities, cyber
attack planning and simulation, source code auditing, and cryptography.
Our results include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http://corelabs.coresecurity.com.


10. *About Core Security Technologies*

Core Security Technologies enables organizations to get ahead of threats
with security test and measurement solutions that continuously identify
and demonstrate real-world exposures to their most critical assets. Our
customers can gain real visibility into their security standing, real
validation of their security controls, and real metrics to more
effectively secure their organizations.

Core Security's software solutions build on over a decade of trusted
research and leading-edge threat expertise from the company's Security
Consulting Services, CoreLabs and Engineering groups. Core Security
Technologies can be reached at +1 (617) 399-6980 or on the Web at:
http://www.coresecurity.com.


11. *Disclaimer*

The contents of this advisory are copyright (c) 2012 Core Security
Technologies and (c) 2012 CoreLabs, and are licensed under a Creative
Commons Attribution Non-Commercial Share-Alike 3.0 (United States)
License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/


12. *PGP/GPG Keys*

This advisory has been signed with the GPG key of Core Security
Technologies advisories team, which is available for download at
http://www.coresecurity.com/files/attachments/core_security_advisories.asc.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (Darwin)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/

iQEcBAEBAgAGBQJQdyjEAAoJEK6bq3WCdh+HiPEH+wVJOMXbci4VXZjJLKuabrM8
sm2l7wdUx7ebPxm5wG05ns+9joRjtiXxXVSZWrpWtrKcTHlPWYm8iPYbnGGOi9vs
NpFz+fMSncT/MIFhQBePJQkcPhEeqVEtdVc+DCXv+WfQ6MNxpbGhLj7O1mXxJOUN
5aes2i8iBVxdzEPydVApG+Fz0YDeonlh7djEKwyUZCzHJlb7ZOUiKtaXLrWM7PLc
+xzMLCaBzm+srm7mo/71nD7/OKcAfR14m8gixxPkjmdWjf831Sd5yeAzZF/o3bAG
RTMsZ2WKNmYqWL+KbdMTmYhF0G2eM0jYmpdkXc7zUhb85GuHJD3PDAQGTjAZkjQ=
=9sT3
-----END PGP SIGNATURE-----


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    34 Files
  • 2
    Jul 2nd
    15 Files
  • 3
    Jul 3rd
    9 Files
  • 4
    Jul 4th
    8 Files
  • 5
    Jul 5th
    2 Files
  • 6
    Jul 6th
    3 Files
  • 7
    Jul 7th
    1 Files
  • 8
    Jul 8th
    15 Files
  • 9
    Jul 9th
    15 Files
  • 10
    Jul 10th
    20 Files
  • 11
    Jul 11th
    17 Files
  • 12
    Jul 12th
    16 Files
  • 13
    Jul 13th
    2 Files
  • 14
    Jul 14th
    1 Files
  • 15
    Jul 15th
    20 Files
  • 16
    Jul 16th
    27 Files
  • 17
    Jul 17th
    7 Files
  • 18
    Jul 18th
    5 Files
  • 19
    Jul 19th
    12 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close