Cisco WebEx fuse File Parsing Heap Overflow Vulnerability

Release date: 2010-08-23
Updated on: 2010-09-02

Affected Systems:
Cisco WebEx Player
Description:
--------------------------------------------------------------------------------
Bugtraq id: 42620

WebEx is the world's largest network communication service provider and can provide telecommunication network conferencing solutions. Currently, WebEx has been acquired by Cisco.

WebEx Player has the heap overflow vulnerability when parsing strings defined in the format of the Ali cloud file. A string prefix is usually a valid length. If the provided string exceeds the defined length, this overflow can be triggered, resulting in arbitrary code execution.

<* Source: Gabriel Menezes Nunes (gab.mnunes@gmail.com)

Link: http://secunia.com/advisories/41039
Http://marc.info /? L = bugtraq & m = 128266487832407 & w = 2
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Cisco
-----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.webex.com/downloadplayer.html