Cisco Webex Player WRF Files Denial of Service Vulnerability

Vulnerability

The vulnerability exists in the Cisco Webex Player for Webex Recording Format (WRF) files. An unauthenticated, remote attacker can cause a denial of service (DoS) condition by providing a specially crafted WRF file to the target user. The affected player is available for Cisco Webex Meetings Suite (WBS31, WBS32, and WBS33) and Cisco Webex Meetings. It is not available for Cisco Webex Meetings Server [1].

Exploitation

An attacker exploits this vulnerability by sending a user a link or email attachment containing a malicious WRF file and persuading the user to open the file with the Cisco Webex Player. No authentication or special network position is required other than the ability to deliver the file to the user [1].

Impact

Successful exploitation causes the affected Cisco Webex Player to crash, resulting in a denial-of-service condition. The attacker does not gain code execution or access to information; only the player's availability is affected [1].

Mitigation

Cisco has not published a fixed version in the available references; users should consult the Cisco bug ID(s) at the top of the advisory and apply any updates released by Cisco. Customers who do not receive automatic software updates may be running versions that have reached end-of-software maintenance and should contact support [1].