Cisco Webex 多个高危误差清静通告
宣布时间 2019-01-25误差编号和级别
CVE编号：CVE-2019-1637，，，，，，，危险级别：高危，，，，，，，CVSS分值：厂商自评：7.8，，，，，，，官方未评定CVE编号：CVE-2019-1638，，，，，，，危险级别：高危，，，，，，，CVSS分值：厂商自评：7.8，，，，，，，官方未评定CVE 编号：CVE-2019-1639，，，，，，，危险级别：高危，，，，，，，CVSS 分值：厂商自评：7.8，，，，，，，官方未评定
CVE 编号：CVE-2019-1640，，，，，，，危险级别：高危，，，，，，，CVSS 分值：厂商自评：7.8，，，，，，，官方未评定
CVE 编号：CVE-2019-1641，，，，，，，危险级别：高危，，，，，，，CVSS 分值：厂商自评：7.8，，，，，，，官方未评定
影响规模
受影响产品：
Cisco Webex Business Suite WBS32 sites — All Webex Network Recording Player and Webex Player versions prior to Version WBS32.15.33
Cisco Webex Business Suite WBS33 sites — All Webex Network Recording Player and Webex Player versions prior to Version WBS33.6.1 or WBS 33.7.0
Cisco Webex Meetings Online — All Webex Network Recording Player and Webex Player versions prior to Version 1.3.40
Cisco Webex Meetings Server — All Webex Network Recording Player versions prior to Version 2.8MR3 SecurityPatch1 or 3.0MR2 SecurityPatch2
误差概述
Cisco Webex Business Suite WBS32 sites等都是美国思科（Cisco）公司的视频聚会解决计划 。。。。。 。Cisco Webex Network Recording Player和Webex Player都是其中的用于播放视频聚会纪录的播放器 。。。。。 。
基于Windows平台的Cisco Webex Network Recording Player和Webex Player中保存的多个误差可能允许攻击者在受影响的系统上执行恣意代码 。。。。。 。误差源于程序过失地验证了ARF和WRF文件 。。。。。 。攻击者可通过链接或邮件附件发送恶意的ARF或WRF文件并诱使用户翻开该文件，，，，，，，使用该误差在受影响系统上执行恣意代码 。。。。。 。
修复建议
现在厂商已宣布升级补丁以修复误差：https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-webex-rce.
Cisco Webex Business Suite WBS32 sites — Webex Network Recording Player and Webex Player Versions WBS32.15.33 and later
Cisco Webex Business Suite WBS33 sites — Webex Network Recording Player and Webex Player Versions WBS33.6.1 and later
Cisco Webex Meetings Online — Webex Network Recording Player and Webex Player Versions 1.3.40 and later
Cisco Webex Meetings Server — Webex Network Recording Player Versions 2.8MR3 SecurityPatch1 or 3.0MR2 SecurityPatch2 and later
参考链接
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-webex-rce
京公网安备11010802024551号