CVE-2010-3269

Related Files

Cisco Security Advisory 20110201-webex

Posted Feb 2, 2011

Authored by Cisco Systems | Site cisco.com

Cisco Security Advisory - Multiple buffer overflow vulnerabilities exist in the Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players. In some cases, exploitation of the vulnerabilities could allow a remote attacker to execute arbitrary code on the system of a targeted user. The Cisco WebEx Players are applications that are used to play back WebEx meeting recordings that have been recorded on the computer of an on-line meeting attendee. The players can be automatically installed when the user accesses a recording file that is hosted on a WebEx server. The player can also be manually installed for offline playback after downloading the application from www.webex.com. If the WebEx recording player was automatically installed, it will be automatically upgraded to the latest, non-vulnerable version when users access a recording file that is hosted on a WebEx server. If the WebEx recording player was manually installed, users will need to manually install a new version of the player after downloading the latest version from www.webex.com. Cisco has released free software updates that address these vulnerabilities.

tags | advisory, remote, overflow, arbitrary, vulnerability

systems | cisco

advisories | CVE-2010-3041, CVE-2010-3042, CVE-2010-3043, CVE-2010-3044, CVE-2010-3269

SHA-256 | b683e91ff48b26c27a3a43efd012c8c476d5f02bdea7b32585bd0c448f52fcac

Download | Favorite | View

Core Security Technologies Advisory 2010.1001

Posted Feb 1, 2011

Authored by Core Security Technologies, Federico Muttis, Sebastian Tello, Manuel Muradas | Site coresecurity.com

Core Security Technologies Advisory - There are stack overflows on WebEx that can be exploited by sending maliciously crafted .atp and .wrf files to a vulnerable WebEx user. When opened, these files trigger a reliably exploitable stack based buffer overflow. Code execution is trivially achieved on the .wrf case because WebEx Player allocates a function pointer on the stack that is periodically used in what seems to be a callback mechanism, and also because DEP and ASLR are not enabled. In the .atp case an exception handler can be overwritten on the stack, and most registers can be trivially overwritten.

tags | advisory, overflow, code execution

advisories | CVE-2010-3269, CVE-2010-3270

SHA-256 | 352f1691497ff70b83f9039f8094fb6c41b1beb68e1b341fbc1f1722864dc8d2

Download | Favorite | View