ID

VAR-201810-0300

CVE

CVE-2018-0422

TITLE

Windows for Cisco Webex Meetings Vulnerabilities related to authorization, permissions, and access control

DESCRIPTION

A vulnerability in the folder permissions of Cisco Webex Meetings client for Windows could allow an authenticated, local attacker to modify locally stored files and execute code on a targeted device with the privilege level of the user. The vulnerability is due to folder permissions that grant a user the permission to read, write, and execute files in the Webex folders. An attacker could exploit this vulnerability to write malicious files to the Webex client directory, affecting all other users of the targeted device. A successful exploit could allow a user to execute commands with elevated privileges. Attacks on single-user systems are less likely to occur, as the attack must be carried out by the user on the user's own system. Multiuser systems have a higher risk of exploitation because folder permissions have an impact on all users of the device. For an attacker to exploit this vulnerability successfully, a second user must execute the locally installed malicious file to allow remote code execution to occur. Windows for Cisco Webex Meetings Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability allows local attackers to escalate privileges on vulnerable installations of Cisco WebEx Network Recording Player. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists in the access control that the product installer sets on the product's binaries. This allows any local user to replace the product's binaries with malicious replacements. An attacker can leverage this vulnerability to escalate privileges to the level of some other user of the system, such as an administrator. Cisco Webex Meetings Client is prone to a local privilege-escalation vulnerability. This issue is being tracked by Cisco bug IDs CSCvh89155, CSCvh89157 and CSCvh89158. Cisco Webex Meetings Suite and others are multi-functional video conferencing solutions of Cisco (Cisco). Webex Meetings client for Windows is a Windows-based video conferencing client software. The following products are affected: Cisco Webex Meetings Suite (WBS31); Cisco Webex Meetings Suite (WBS32); Cisco Webex Meetings Suite (WBS33); Cisco Webex Meetings; Cisco Webex Meetings Server

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

local

TYPE

permissions and access control

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Simon Zuckerbraun of Trend Micro Zero Day Initiative

SOURCES

LAST UPDATE DATE

2024-11-23T22:21:55.278000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE