Vulnerability Note VU#909240
Cisco WebEx web browser extension allows arbitrary code execution
Overview
The Cisco WebEx extensions for Chrome, Firefox, and Internet Explorer allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable Windows system.
Description
Cisco WebEx is a suite of online meeting software. WebEx meetings are usually joined through a web browser link. The WebEx software is launched through use of a web browser extension. The Cisco WebEx web browser extension allows a remote attacker to execute arbitrary code on a vulnerable Windows system. The WebEx Google Chrome extension versions older than 1.0.7 are affected. |
Impact
By convincing a user to visit a specially-crafted web page, a remote attacker may be able to execute arbitrary code on a vulnerable system. |
Solution
Apply an update |
Disable the WebEx ActiveX control in Internet Explorer {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} More information about how to set the kill bit is available in Microsoft Support Document 240797. Alternatively, the following text can be saved as a .REG file and imported to set the kill bit for this control:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E06E2E99-0AA1-11D4-ABA6-0060082AA75C}] "Compatibility Flags"=dword:00000400 [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E06E2E99-0AA1-11D4-ABA6-0060082AA75C}] "Compatibility Flags"=dword:00000400 Since Internet Explorer version 8, ActiveX controls require per-site activation before they execute. Note, however, that per-site ActiveX in Internet Explorer occurs on the domain level, rather than the subdomain level. For example, if a user has agreed to run the WebEx ActiveX control on any foo.webex.com domain, then it will run without prompting on any bar.webex.com domain. Disable the WebEx plugin in Firefox The vulnerable WebEx Firefox plugin can be disabled by visiting about:addons, viewing the Plugins section and selecting Never Activate for the ActiveTouch General Plugin Container plugin. Note that in the default configuration of Firefox, the browser will prompt the user before running the plugin upon visiting each new subdomain. This may help prevent a "drive-by download" attack without user interaction on Firefox. Uninstall WebEx software According to the Cisco Security Advisory, this vulnerability can be mitigated on all browsers by running the Meeting Services Removal Tool, which is available from https://help.webex.com/docs/DOC-2672. |
Vendor Information (Learn More)
Vendor | Status | Date Notified | Date Updated |
---|---|---|---|
Cisco | Affected | - | 27 Jan 2017 |
CVSS Metrics (Learn More)
Group | Score | Vector |
---|---|---|
Base | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Temporal | 6.8 | E:F/RL:W/RC:C |
Environmental | 6.8 | CDP:ND/TD:H/CR:ND/IR:ND/AR:ND |
References
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170124-webex
- https://help.webex.com/docs/DOC-2672
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1096
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1100
- https://blog.filippo.io/webex-extension-vulnerability/
- https://msdn.microsoft.com/en-us/library/dd433050(v=vs.85).aspx#_user
Credit
This vulnerability was publicly reported by Tavis Ormandy.
This document was written by Will Dormann.
Other Information
- CVE IDs: CVE-2017-3823
- Date Public: 23 Jan 2017
- Date First Published: 27 Jan 2017
- Date Last Updated: 27 Jan 2017
- Document Revision: 17
Feedback
If you have feedback, comments, or additional information about this vulnerability, please send us email.