Details of VAR-201908-1010

ID

VAR-201908-1010

CVE

CVE-2019-1925

TITLE

Microsoft Windows for Cisco Webex Network Recording Player and Webex Player Buffer error vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-007600

DESCRIPTION

Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user

Trust: 1.71

sources: NVD: CVE-2019-1925 // JVNDB: JVNDB-2019-007600 // VULHUB: VHN-151677

AFFECTED PRODUCTS

vendor:	cisco	model:	webex meetings online	scope:	lt	version:	1.3.43	Trust: 1.0
vendor:	cisco	model:	webex meetings server	scope:	eq	version:	2.8	Trust: 1.0
vendor:	cisco	model:	webex business suite	scope:	lt	version:	39.5.5	Trust: 1.0
vendor:	cisco	model:	webex meetings server	scope:	eq	version:	4.0	Trust: 1.0
vendor:	cisco	model:	webex meetings server	scope:	eq	version:	3.0mr2	Trust: 1.0
vendor:	cisco	model:	webex meetings server	scope:	eq	version:	3.0	Trust: 1.0
vendor:	cisco	model:	webex business suite	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	webex meetings online	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	webex meetings server	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2019-007600 // NVD: CVE-2019-1925

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-1925
value:	HIGH
Trust: 1.0
ykramarz@cisco.com:	CVE-2019-1925
value:	HIGH
Trust: 1.0
NVD:	CVE-2019-1925
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201908-535
value:	HIGH
Trust: 0.6
VULHUB:	VHN-151677
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2019-1925
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-151677
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

ykramarz@cisco.com:	CVE-2019-1925
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.0
Trust: 1.8
nvd@nist.gov:	CVE-2019-1925
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 1.0

sources: VULHUB: VHN-151677 // JVNDB: JVNDB-2019-007600 // CNNVD: CNNVD-201908-535 // NVD: CVE-2019-1925 // NVD: CVE-2019-1925

PROBLEMTYPE DATA

problemtype:

CWE-119

Trust: 1.9

sources: VULHUB: VHN-151677 // JVNDB: JVNDB-2019-007600 // NVD: CVE-2019-1925

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201908-535

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201908-535

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-007600

PATCH

title:	cisco-sa-20190807-webex-player	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-webex-player	Trust: 0.8
title:	Cisco Webex Network Recording Player and Webex Player for Microsoft Windows Buffer error vulnerability fix	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=96232	Trust: 0.6

sources: JVNDB: JVNDB-2019-007600 // CNNVD: CNNVD-201908-535

EXTERNAL IDS

db:	NVD	id:	CVE-2019-1925	Trust: 2.5
db:	JVNDB	id:	JVNDB-2019-007600	Trust: 0.8
db:	CNNVD	id:	CNNVD-201908-535	Trust: 0.7
db:	AUSCERT	id:	ESB-2019.2994	Trust: 0.6
db:	VULHUB	id:	VHN-151677	Trust: 0.1

sources: VULHUB: VHN-151677 // JVNDB: JVNDB-2019-007600 // CNNVD: CNNVD-201908-535 // NVD: CVE-2019-1925

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190807-webex-player	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2019-1925	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-1925	Trust: 0.8
url:	https://www.auscert.org.au/bulletins/esb-2019.2994/	Trust: 0.6

sources: VULHUB: VHN-151677 // JVNDB: JVNDB-2019-007600 // CNNVD: CNNVD-201908-535 // NVD: CVE-2019-1925

CREDITS

Yici Wang and Kushal Arvind Shah of Fortinet’s FortiGuard Labs for reporting these vulnerabilities.

Trust: 0.6

sources: CNNVD: CNNVD-201908-535

SOURCES

db:	VULHUB	id:	VHN-151677
db:	JVNDB	id:	JVNDB-2019-007600
db:	CNNVD	id:	CNNVD-201908-535
db:	NVD	id:	CVE-2019-1925

LAST UPDATE DATE

2024-11-23T21:36:58.189000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-151677	date:	2023-03-03T00:00:00
db:	JVNDB	id:	JVNDB-2019-007600	date:	2019-08-15T00:00:00
db:	CNNVD	id:	CNNVD-201908-535	date:	2019-08-15T00:00:00
db:	NVD	id:	CVE-2019-1925	date:	2024-11-21T04:37:41.960

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-151677	date:	2019-08-07T00:00:00
db:	JVNDB	id:	JVNDB-2019-007600	date:	2019-08-15T00:00:00
db:	CNNVD	id:	CNNVD-201908-535	date:	2019-08-07T00:00:00
db:	NVD	id:	CVE-2019-1925	date:	2019-08-07T21:15:11.423