Quit WebEx now if you want to live! (Bad bugs, not killer slideware)

It’s time for Cisco’s Midweek Misery, netadmins, with four critical vulns to patch and a slew of others to look over if you have time.

WebEx has two nasties, CVE-2018-0112 and CVE-2018-0264.

CVE-2018-0112 is a remote code execution (RCE) vulnerability in two clients (the WebEx Business Suite client and WebEx Meetings), and the WebEx Meetings Server.

It’s an input validation slip-up that means an attacker can share a malicious Flash file (extension .swf) within WebEx and execute code on a victim’s machine. If you can’t patch with a new version, Cisco’s advisory links to WebEx removal instructions.

The other bug, CVE-2018-0264, is in WebEx Network Recording Player for Advanced Recording Format (ARF), and is also an RCE vulnerability. Again, it’s exploited with a malicious file – this time, the ARF format that records meetings – and if the victim is persuaded to click the link, they’re pwned.

The Cisco Secure Access Control System has a message validation vulnerability (CVE-2018-0253) that leads to, you guessed it, RCE. Its Action Message Format (AMF) protocol can let a malicious message containing attack code through, letting an attacker execute arbitrary commands on the ACS device.

In the final critical vulnerability this week, CVE-2018-0258, the Cisco Prime File Upload servlet has a path traversal bug.

An attacker can upload files to any directory of a vulnerable device, and then execute those files.

Cisco also disclosed five vulnerabilities rated “High”, in its wireless LAN controllers (here and here), Meeting Server (not the WebEx server), two in various Aironet products (here and here), and one in IOS, IOS XE, and IOS XR. ®

Sponsored: Minds Mastering Machines – Call for papers now open

Read More HERE