Details of VAR-201908-0542

ID

VAR-201908-0542

CVE

CVE-2019-1928

TITLE

Microsoft Windows for Cisco Webex Network Recording Player and Webex Player Buffer error vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-007667

DESCRIPTION

Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user. The vulnerability is caused by the program not properly validating ARF and WRF files

Trust: 1.71

sources: NVD: CVE-2019-1928 // JVNDB: JVNDB-2019-007667 // VULHUB: VHN-151710

AFFECTED PRODUCTS

vendor:	cisco	model:	webex meetings online	scope:	lt	version:	1.3.43	Trust: 1.0
vendor:	cisco	model:	webex meetings server	scope:	eq	version:	2.8	Trust: 1.0
vendor:	cisco	model:	webex business suite	scope:	lt	version:	39.5.5	Trust: 1.0
vendor:	cisco	model:	webex meetings server	scope:	eq	version:	4.0	Trust: 1.0
vendor:	cisco	model:	webex meetings server	scope:	eq	version:	3.0mr2	Trust: 1.0
vendor:	cisco	model:	webex meetings server	scope:	eq	version:	3.0	Trust: 1.0
vendor:	cisco	model:	webex business suite	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	webex meetings online	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	webex meetings server	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2019-007667 // NVD: CVE-2019-1928

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-1928
value:	HIGH
Trust: 1.0
ykramarz@cisco.com:	CVE-2019-1928
value:	HIGH
Trust: 1.0
NVD:	CVE-2019-1928
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201908-542
value:	HIGH
Trust: 0.6
VULHUB:	VHN-151710
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2019-1928
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-151710
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

ykramarz@cisco.com:	CVE-2019-1928
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.0
Trust: 1.8
nvd@nist.gov:	CVE-2019-1928
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 1.0

sources: VULHUB: VHN-151710 // JVNDB: JVNDB-2019-007667 // CNNVD: CNNVD-201908-542 // NVD: CVE-2019-1928 // NVD: CVE-2019-1928

PROBLEMTYPE DATA

problemtype:

CWE-119

Trust: 1.9

sources: VULHUB: VHN-151710 // JVNDB: JVNDB-2019-007667 // NVD: CVE-2019-1928

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201908-542

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201908-542

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-007667

PATCH

title:	cisco-sa-20190807-webex-player	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-webex-player	Trust: 0.8
title:	Cisco Webex Network Recording Player and Cisco Webex Player Buffer error vulnerability fix	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=96239	Trust: 0.6

sources: JVNDB: JVNDB-2019-007667 // CNNVD: CNNVD-201908-542

EXTERNAL IDS

db:	NVD	id:	CVE-2019-1928	Trust: 2.5
db:	JVNDB	id:	JVNDB-2019-007667	Trust: 0.8
db:	CNNVD	id:	CNNVD-201908-542	Trust: 0.7
db:	AUSCERT	id:	ESB-2019.2994	Trust: 0.6
db:	VULHUB	id:	VHN-151710	Trust: 0.1

sources: VULHUB: VHN-151710 // JVNDB: JVNDB-2019-007667 // CNNVD: CNNVD-201908-542 // NVD: CVE-2019-1928

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190807-webex-player	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2019-1928	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-1928	Trust: 0.8
url:	https://www.auscert.org.au/bulletins/esb-2019.2994/	Trust: 0.6

sources: VULHUB: VHN-151710 // JVNDB: JVNDB-2019-007667 // CNNVD: CNNVD-201908-542 // NVD: CVE-2019-1928

CREDITS

Yici Wang and Kushal Arvind Shah of Fortinet’s FortiGuard Labs for reporting these vulnerabilities.

Trust: 0.6

sources: CNNVD: CNNVD-201908-542

SOURCES

db:	VULHUB	id:	VHN-151710
db:	JVNDB	id:	JVNDB-2019-007667
db:	CNNVD	id:	CNNVD-201908-542
db:	NVD	id:	CVE-2019-1928

LAST UPDATE DATE

2024-11-23T21:36:58.318000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-151710	date:	2023-03-08T00:00:00
db:	JVNDB	id:	JVNDB-2019-007667	date:	2019-08-16T00:00:00
db:	CNNVD	id:	CNNVD-201908-542	date:	2019-08-19T00:00:00
db:	NVD	id:	CVE-2019-1928	date:	2024-11-21T04:37:42.327

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-151710	date:	2019-08-07T00:00:00
db:	JVNDB	id:	JVNDB-2019-007667	date:	2019-08-16T00:00:00
db:	CNNVD	id:	CNNVD-201908-542	date:	2019-08-07T00:00:00
db:	NVD	id:	CVE-2019-1928	date:	2019-08-07T22:15:15.713