Details of VAR-202106-0916

ID

VAR-202106-0916

CVE

CVE-2021-1527

TITLE

Windows and MacOS for Cisco Webex Player Out-of-bounds Vulnerability in Microsoft

Trust: 0.8

sources: JVNDB: JVNDB-2021-001956

DESCRIPTION

A vulnerability in Cisco Webex Player for Windows and MacOS could allow an attacker to cause the affected software to terminate or to gain access to memory state information that is related to the vulnerable application. The vulnerability is due to insufficient validation of values in Webex recording files that are stored in Webex Recording Format (WRF). An attacker could exploit this vulnerability by sending a malicious WRF file to a user as a link or email attachment and then persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to crash the affected software and view memory state information. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. Cisco Webex Network Webex Player is a player used by Cisco to play video conference records

Trust: 2.25

sources: NVD: CVE-2021-1527 // JVNDB: JVNDB-2021-001956 // CNNVD: CNNVD-202104-975 // VULHUB: VHN-374581

AFFECTED PRODUCTS

vendor:	cisco	model:	webex player	scope:	lt	version:	41.5	Trust: 1.0
vendor:	シスコシステムズ	model:	cisco webex player	scope:	eq	version:	-	Trust: 0.8
vendor:	シスコシステムズ	model:	cisco webex player	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2021-001956 // NVD: CVE-2021-1527

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-1527
value:	MEDIUM
Trust: 1.0
ykramarz@cisco.com:	CVE-2021-1527
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2021-1527
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-202104-975
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-202106-120
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-374581
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2021-1527
severity:	MEDIUM
baseScore:	5.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:N/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-374581
severity:	MEDIUM
baseScore:	5.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:N/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2021-1527
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	4.2
version:	3.1
Trust: 1.0
ykramarz@cisco.com:	CVE-2021-1527
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	1.8
impactScore:	3.4
version:	3.1
Trust: 1.0
NVD:	CVE-2021-1527
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-374581 // JVNDB: JVNDB-2021-001956 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-120 // NVD: CVE-2021-1527 // NVD: CVE-2021-1527

PROBLEMTYPE DATA

problemtype:	CWE-787	Trust: 1.1
problemtype:	CWE-119	Trust: 1.0
problemtype:	Out-of-bounds writing (CWE-787) [NVD Evaluation ]	Trust: 0.8

sources: VULHUB: VHN-374581 // JVNDB: JVNDB-2021-001956 // NVD: CVE-2021-1527

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202106-120

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202104-975

PATCH

title:

cisco-sa-webex-player-kxtkFbnR

url:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-player-kxtkFbnR

Trust: 0.8

sources: JVNDB: JVNDB-2021-001956

EXTERNAL IDS

db:	NVD	id:	CVE-2021-1527	Trust: 2.5
db:	JVNDB	id:	JVNDB-2021-001956	Trust: 0.8
db:	CS-HELP	id:	SB2021041363	Trust: 0.6
db:	CNNVD	id:	CNNVD-202104-975	Trust: 0.6
db:	CS-HELP	id:	SB2021060214	Trust: 0.6
db:	AUSCERT	id:	ESB-2021.1908	Trust: 0.6
db:	CNNVD	id:	CNNVD-202106-120	Trust: 0.6
db:	VULHUB	id:	VHN-374581	Trust: 0.1

sources: VULHUB: VHN-374581 // JVNDB: JVNDB-2021-001956 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-120 // NVD: CVE-2021-1527

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-webex-player-kxtkfbnr	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2021-1527	Trust: 0.8
url:	https://www.cybersecurity-help.cz/vdb/sb2021041363	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2021.1908	Trust: 0.6
url:	https://www.cybersecurity-help.cz/vdb/sb2021060214	Trust: 0.6

sources: VULHUB: VHN-374581 // JVNDB: JVNDB-2021-001956 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-120 // NVD: CVE-2021-1527

SOURCES

db:	VULHUB	id:	VHN-374581
db:	JVNDB	id:	JVNDB-2021-001956
db:	CNNVD	id:	CNNVD-202104-975
db:	CNNVD	id:	CNNVD-202106-120
db:	NVD	id:	CVE-2021-1527

LAST UPDATE DATE

2024-08-14T13:12:16.721000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-374581	date:	2021-06-14T00:00:00
db:	JVNDB	id:	JVNDB-2021-001956	date:	2021-07-06T02:54:00
db:	CNNVD	id:	CNNVD-202104-975	date:	2021-04-14T00:00:00
db:	CNNVD	id:	CNNVD-202106-120	date:	2021-06-15T00:00:00
db:	NVD	id:	CVE-2021-1527	date:	2023-11-07T03:28:32.287

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-374581	date:	2021-06-04T00:00:00
db:	JVNDB	id:	JVNDB-2021-001956	date:	2021-07-06T00:00:00
db:	CNNVD	id:	CNNVD-202104-975	date:	2021-04-13T00:00:00
db:	CNNVD	id:	CNNVD-202106-120	date:	2021-06-02T00:00:00
db:	NVD	id:	CVE-2021-1527	date:	2021-06-04T17:15:08.903