First published: Fri Oct 05 2018(Updated: )
A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
Credit: ykramarz@cisco.com
Affected Software | Affected Version | How to fix |
---|---|---|
Cisco Webex Meetings Online | <1.3.37 | |
Cisco WebEx Meetings Server | =2.5-maintenance_release2_patch1 | |
Cisco WebEx Meetings Server | =2.5-maintenance_release5_patch1 | |
Cisco WebEx Meetings Server | =2.5-maintenance_release6_patch2 | |
Cisco WebEx Meetings Server | =2.5-maintenance_release6_patch3 | |
Cisco WebEx Meetings Server | =2.5-maintenance_release6_patch4 | |
Cisco WebEx Meetings Server | =2.5.1.29 | |
Cisco WebEx Meetings Server | =2.6 | |
Cisco WebEx Meetings Server | =2.6-maintenance_release1_patch1 | |
Cisco WebEx Meetings Server | =2.6-maintenance_release2_patch1 | |
Cisco WebEx Meetings Server | =2.6-maintenance_release3_patch1 | |
Cisco WebEx Meetings Server | =2.6-maintenance_release3_patch2 | |
Cisco WebEx Meetings Server | =2.7 | |
Cisco WebEx Meetings Server | =2.7-base | |
Cisco WebEx Meetings Server | =2.7-maintenance_release1_patch1 | |
Cisco WebEx Meetings Server | =2.7-maintenance_release2_patch1 | |
Cisco WebEx Meetings Server | =2.7.1 | |
Cisco WebEx Meetings Server | =2.8 | |
Cisco WebEx Meetings Server | =2.8-base | |
Cisco Webex Business Suite 32 | <32.15.10 | |
Cisco Webex Business Suite 33 | <33.3 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2018-15414 is a vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows that allows an attacker to execute arbitrary code on an affected system.
CVE-2018-15414 has a severity value of 7.8, which is considered critical.
CVE-2018-15414 affects Cisco Webex Meetings Online, Cisco WebEx Meetings Server (versions 2.5 to 2.8), and Cisco Webex Business Suite (versions 32 and 33).
To fix CVE-2018-15414, it is recommended to update to the latest version of the affected software. Cisco has released security updates to address this vulnerability.
You can find more information about CVE-2018-15414 on the following websites: [SecurityFocus](http://www.securityfocus.com/bid/105374), [SecurityTracker](http://www.securitytracker.com/id/1041689), and [Cisco Security Advisory](https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180919-webex).