Cisco Webex Meetings Client for Windows Privilege Escalation Vulnerability [CVE-2018-0422]
CVE Number – CVE-2018-0422
A vulnerability in the folder permissions of Cisco Webex Meetings client for Windows could allow an authenticated, local attacker to modify locally stored files and execute code on a targeted device with the privilege level of the user.
The vulnerability is due to folder permissions that grant a user the permission to read, write, and execute files in the Webex folders. An attacker could exploit this vulnerability to write malicious files to the Webex client directory, affecting all other users of the targeted device. A successful exploit could allow a user to execute commands with elevated privileges.
Attacks on single-user systems are less likely to occur, as the attack must be carried out by the user on the user’s own system. Multiuser systems have a higher risk of exploitation because folder permissions have an impact on all users of the device. For an attacker to exploit this vulnerability successfully, a second user must execute the locally installed malicious file to allow remote code execution to occur.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-webex-pe
-
Vulnerable Products
This vulnerability affects client applications installed from the following Cisco Webex Meetings products when running on Microsoft Windows end-user systems:
- Cisco Webex Meetings Suite (WBS31)
- Cisco Webex Meetings Suite (WBS32)
- Cisco Webex Meetings Suite (WBS33)
- Cisco Webex Meetings
- Cisco Webex Meetings Server
To determine whether a Cisco Webex meeting site is running an affected version of the Webex software, users can log in to their Cisco Webex meeting site and go to Support > Downloads. The version of the Webex software will be displayed on the right side of the page under About Meeting Center. See the Fixed Software section of this advisory for details.
Alternatively, version information for the Cisco Webex meeting client can be accessed directly in the client. Version information for the Cisco Webex meeting client on Windows platforms can be viewed by choosing Help > About Cisco Webex Meeting Center.
Note: Customers who do not receive automatic software updates may be running versions of Cisco Webex Meetings that have reached end of software maintenance and should contact the Cisco TAC (Technical Assistance Center).
Products Confirmed Not Vulnerable
Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.
Cisco has confirmed that this vulnerability does not affect Cisco Webex Meetings client applications running on Mac OS X and Linux operating systems.
-
Cisco will release free software updates that address the vulnerability described in this advisory. Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license:
https://www.cisco.com/c/en/us/products/end-user-license-agreement.htmlAdditionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades.
When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories and Alerts page, to determine exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
Customers Without Service Contracts
Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC:
https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.htmlCustomers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.
Fixed Releases
Cisco has released new desktop applications to remediate this vulnerability. Users must have the new desktop applications installed to remediate the vulnerability.
Users can obtain the installable MSI from their upgraded site. For WBS33, the applications are automatically delivered and installed automatically when administrative users attend a meeting on a WBS33 site.
Users without administrative rights will not be able to install the update automatically and will require administrators to install the application installable MSI on their desktops.
Due to customers’ lock down status of WBS 32, users or IT administrators must install the desktop applications manually.
Users or IT administrators can contact the Cisco TAC to obtain the desktop applications’ installable MSI prior to their site’s upgrade.
Further Information
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-webex-pe
Duncan is a technology professional with over 20 years experience of working in various IT roles. He has a interest in cyber security, and has a wide range of other skills in radio, electronics and telecommunications.