====================================================================

                              CERT-Renater

                 Note d'Information No. 2017/VULN369
_____________________________________________________________________

DATE                : 29/11/2017

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Cisco WebEx Business Suite,
                      Cisco WebEx Meetings, Cisco WebEx Meeting Server,
                      Cisco WebEx ARF Player,Cisco WebEx WRF Player.

=====================================================================
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-webex-players
_____________________________________________________________________

Cisco Security Advisory: Multiple Vulnerabilities in Cisco WebEx
Recording Format and Advanced Recording Format Players

Advisory ID: cisco-sa-20171129-webex-players

Revision: 1.0

For Public Release: 2017 November 29 16:00 GMT

Last Updated: 2017 November 29 16:00 GMT

CVE ID(s): CVE-2017-12367, CVE-2017-12368, CVE-2017-12369,
CVE-2017-12370, CVE-2017-12371, CVE-2017-12372

CVSS Score v(3): 9.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

+---------------------------------------------------------------------

Summary
=======
Multiple vulnerabilities exist in Cisco WebEx Network Recording Player
for Advanced Recording Format (ARF) and WebEx Recording Format (WRF)
files. A remote attacker could exploit these vulnerabilities by
providing a user with a malicious ARF or WRF file via email or URL and
convincing the user to launch the file. Exploitation of these
vulnerabilities could cause an affected player to crash and, in some
cases, could allow arbitrary code execution on the system of a targeted
user.

The Cisco WebEx players are applications that are used to play back
WebEx meeting recordings that have been recorded by an online meeting
attendee. The player can be automatically installed when the user
accesses a recording file that is hosted on a WebEx server.

Cisco has updated affected versions of the Cisco WebEx Business Suite
meeting sites, Cisco WebEx Meetings sites, Cisco WebEx Meetings Server,
and Cisco WebEx ARF and WRF Players to address these vulnerabilities.
There are no workarounds that address these vulnerabilities.

This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-webex-players
["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-webex-players"]

==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================