ISC Diary

Cisco WebEx WRF Player Vulnerabilities

Published: 2009-12-16,
Last Updated: 2009-12-16 20:00:37 UTC
by Rob VandenBrink (Version: 1)

Cisco today released details of a set of buffer overflow vulnerabilities and fixes for their WebEx WRF player. The exploits describe multiple buffer overflows caused by a maliciously crafted WRF file (generally posted on a website), or by attending a WebEx meeting with an attacker attending. The results of the exploit can result in execution of arbitrary code on the target system.

The exploits are categorized as: CVE-2009-2875, CVE-2009-2876, CVE-2009-2877, CVE-2009-2878, CVE-2009-2879 and CVE-2009-2880.

The WebEx site itself has the fixed client code. If you have an inhouse WebEx server, updating the server updates all the clients (as they connect). You won't find an easier to install fix than this one!

From the Cisco advisory, the "first fixed" releases are listed below, by Major Release and Client OS. All versions subsequent to these are fixed as well.

Platform	Major Release 26.x	Major Release 27.x
Microsoft Windows	26.49.32; available now except lockdown sites	27.10.x; available now for non-PSO and non-lockdown sites
Mac OS X	26.49.35; available early February 2010	27.11.8; available now for non-PSO and non-lockdown sites
Linux	26.49.35; available early February 2010	27.11.8; available now for non-PSO and non-lockdown sites