Sign-up

ID

VAR-201711-0378


CVE

CVE-2017-12367


TITLE

Cisco WebEx Network Recording Player for Advanced Recording Format and WebEx Recording Format Input validation vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-010390

DESCRIPTION

A "Cisco WebEx Network Recording Player Denial of Service Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) and WebEx Recording Format (WRF) files. A remote attacker could exploit this by providing a user with a malicious ARF or WRF file via email or URL and convincing the user to launch the file. Exploitation of this could cause an affected player to crash and, in some cases, could allow arbitrary code execution on the system of a targeted user. Cisco Bug IDs: CSCve11545, CSCve02843, CSCve11548. Vendors have confirmed this vulnerability Bug ID CSCve11545 , CSCve02843 and CSCve11548 It is released as.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Multiple Cisco WebEx Products are prone to the following security vulnerabilities: 1. Multiple remote code-execution vulnerabilities 2. Failed exploit attempts will likely result in denial-of-service conditions. Cisco WebEx Business Suite (WBS30) client and so on are the client software of Cisco's video conferencing solution. The following products and versions are affected: Cisco WebEx Business Suite (WBS30) client builds prior to T30.20; WebEx Business Suite (WBS31) client builds prior to T31.14.1; WebEx Business Suite (WBS32) client builds prior to T32.2 versions before WebEx Meetings with client builds prior to T31.14; versions prior to WebEx Meeting Server builds 2.7MR3

Trust: 2.07

sources: NVD: CVE-2017-12367 // JVNDB: JVNDB-2017-010390 // BID: 102017 // VULHUB: VHN-102882 // VULMON: CVE-2017-12367

AFFECTED PRODUCTS

vendor:ciscomodel:webex meetings serverscope:eqversion:t30

Trust: 1.6

vendor:ciscomodel:webex meetings serverscope:eqversion:t31.11.2

Trust: 1.6

vendor:ciscomodel:webex meetings serverscope:eqversion:t29

Trust: 1.6

vendor:ciscomodel:webex business suite clientscope:eqversion:0

Trust: 0.9

vendor:ciscomodel:webex meetings serverscope: - version: -

Trust: 0.8

vendor:ciscomodel:webex meetings clientscope:eqversion:0

Trust: 0.3

vendor:ciscomodel:webex meeting serverscope:eqversion:0

Trust: 0.3

vendor:ciscomodel:webex business suite client t31.10scope: - version: -

Trust: 0.3

vendor:ciscomodel:webex business suite client t30.17scope: - version: -

Trust: 0.3

vendor:ciscomodel:webex meetings client t31.14scope:neversion: -

Trust: 0.3

vendor:ciscomodel:webex meeting server 2.7mr3scope:neversion: -

Trust: 0.3

vendor:ciscomodel:webex business suite client t32.2scope:neversion: -

Trust: 0.3

vendor:ciscomodel:webex business suite client t31.14.1scope:neversion: -

Trust: 0.3

vendor:ciscomodel:webex business suite client t30.20scope:neversion: -

Trust: 0.3

sources: BID: 102017 // JVNDB: JVNDB-2017-010390 // CNNVD: CNNVD-201711-1140 // NVD: CVE-2017-12367

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-12367
value: CRITICAL

Trust: 1.0

NVD: CVE-2017-12367
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-201711-1140
value: CRITICAL

Trust: 0.6

VULHUB: VHN-102882
value: MEDIUM

Trust: 0.1

VULMON: CVE-2017-12367
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2017-12367
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-102882
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-12367
baseSeverity: CRITICAL
baseScore: 9.6
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 6.0
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-102882 // VULMON: CVE-2017-12367 // JVNDB: JVNDB-2017-010390 // CNNVD: CNNVD-201711-1140 // NVD: CVE-2017-12367

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

problemtype:CWE-119

Trust: 1.0

sources: VULHUB: VHN-102882 // JVNDB: JVNDB-2017-010390 // NVD: CVE-2017-12367

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201711-1140

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201711-1140

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-010390

PATCH
title:cisco-sa-20171129-webex-playersurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-webex-players
Trust: 0.8
title:Multiple Cisco product WebEx Recording Format Player  and Advanced Recording Format Player Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=76795
Trust: 0.6
title:Cisco: Multiple Vulnerabilities in Cisco WebEx Recording Format and Advanced Recording Format Playersurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-20171129-webex-players
Trust: 0.1
title:Threatposturl:https://threatpost.com/cisco-patches-critical-playback-bugs-in-webex-players/129057/
Trust: 0.1
sources:
            
            
            VULMON: CVE-2017-12367 // 
            
            
            
            JVNDB: JVNDB-2017-010390 // 
            
            
            
            CNNVD: CNNVD-201711-1140

EXTERNAL IDS
db:NVDid:CVE-2017-12367
Trust: 3.0
db:BIDid:102017
Trust: 2.1
db:SECTRACKid:1039895
Trust: 1.8
db:JVNDBid:JVNDB-2017-010390
Trust: 0.8
db:CNNVDid:CNNVD-201711-1140
Trust: 0.7
db:PACKETSTORMid:145176
Trust: 0.2
db:VULHUBid:VHN-102882
Trust: 0.1
db:VULMONid:CVE-2017-12367
Trust: 0.1
sources:
            
            
            VULHUB: VHN-102882 // 
            
            
            
            VULMON: CVE-2017-12367 // 
            
            
            
            BID: 102017 // 
            
            
            
            JVNDB: JVNDB-2017-010390 // 
            
            
            
            PACKETSTORM: 145176 // 
            
            
            
            CNNVD: CNNVD-201711-1140 // 
            
            
            
            NVD: CVE-2017-12367

REFERENCES
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20171129-webex-players
Trust: 2.2
url:http://www.securityfocus.com/bid/102017
Trust: 1.8
url:http://www.securitytracker.com/id/1039895
Trust: 1.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-12367
Trust: 0.9
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-12367
Trust: 0.8
url:http://www.cisco.com/
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/20.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://threatpost.com/cisco-patches-critical-playback-bugs-in-webex-players/129057/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-12372
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-12369
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-12368
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-12370
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-12371
Trust: 0.1
sources:
            
            
            VULHUB: VHN-102882 // 
            
            
            
            VULMON: CVE-2017-12367 // 
            
            
            
            BID: 102017 // 
            
            
            
            JVNDB: JVNDB-2017-010390 // 
            
            
            
            PACKETSTORM: 145176 // 
            
            
            
            CNNVD: CNNVD-201711-1140 // 
            
            
            
            NVD: CVE-2017-12367

CREDITS
Yihan Lian, Fortinet, and Trend Micro.
Trust: 0.3
sources:
            
            
            BID: 102017

SOURCES
db:VULHUBid:VHN-102882
db:VULMONid:CVE-2017-12367
db:BIDid:102017
db:JVNDBid:JVNDB-2017-010390
db:PACKETSTORMid:145176
db:CNNVDid:CNNVD-201711-1140
db:NVDid:CVE-2017-12367

LAST UPDATE DATE
2024-11-23T22:22:22.013000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-102882date:2019-10-09T00:00:00
db:VULMONid:CVE-2017-12367date:2019-10-09T00:00:00
db:BIDid:102017date:2017-12-19T22:01:00
db:JVNDBid:JVNDB-2017-010390date:2017-12-13T00:00:00
db:CNNVDid:CNNVD-201711-1140date:2019-10-17T00:00:00
db:NVDid:CVE-2017-12367date:2024-11-21T03:09:23.853

SOURCES RELEASE DATE
db:VULHUBid:VHN-102882date:2017-11-30T00:00:00
db:VULMONid:CVE-2017-12367date:2017-11-30T00:00:00
db:BIDid:102017date:2017-11-29T00:00:00
db:JVNDBid:JVNDB-2017-010390date:2017-12-13T00:00:00
db:PACKETSTORMid:145176date:2017-12-01T03:05:38
db:CNNVDid:CNNVD-201711-1140date:2017-11-30T00:00:00
db:NVDid:CVE-2017-12367date:2017-11-30T09:29:01.557