« Volver al listado

CVE-2017-12359

Estado: ModificadaMedia (6.5)—

A Buffer Overflow vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (.arf) files could allow an attacker to execute arbitrary code on a system. An attacker could exploit this vulnerability by providing a user with a malicious .arf file via email or URL and convincing the user to launch the file. Exploitation of this vulnerability could allow arbitrary code execution on the system of the targeted user. This vulnerability affects Cisco WebEx Business Suite meeting sites, Cisco WebEx Meetings sites, Cisco WebEx Meetings Server, and Cisco WebEx ARF players. Cisco Bug IDs: CSCve10729, CSCve10771, CSCve10779, CSCve11521, CSCve11543.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Cisco — Webex Meeting CenterCisco — Webex Meetings Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-12359",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Cisco WebEx Network Recording Player",
          "versions": [
            {
              "status": "affected",
              "version": "Cisco WebEx Network Recording Player"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-11-30T09:29:01.277",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/102186",
      "source": "psirt@cisco.com"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-webex",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/102186",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-webex",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@cisco.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Buffer Overflow vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (.arf) files could allow an attacker to execute arbitrary code on a system. An attacker could exploit this vulnerability by providing a user with a malicious .arf file via email or URL and convincing the user to launch the file. Exploitation of this vulnerability could allow arbitrary code execution on the system of the targeted user. This vulnerability affects Cisco WebEx Business Suite meeting sites, Cisco WebEx Meetings sites, Cisco WebEx Meetings Server, and Cisco WebEx ARF players. Cisco Bug IDs: CSCve10729, CSCve10771, CSCve10779, CSCve11521, CSCve11543."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de desbordamiento de búfer en Cisco WebEx Network Recording Player para archivos Advanced Recording Format (.arf) podría permitir que un atacante ejecute código arbitrario en un sistema. Un atacante podría explotar esta vulnerabilidad proporcionándole a un usuario un archivo .arf malicioso mediante correo electrónico o URL y convenciéndolo para que ejecute el archivo. La explotación de esta vulnerabilidad podría permitir la ejecución de código arbitrario en el sistema del usuario objetivo. Esta vulnerabilidad afecta a sitios de reunión Cisco WebEx Business Suite, Cisco WebEx Meetings, Cisco WebEx Meetings Server y a los reproductores Cisco WebEx ARF. Cisco Bug IDs: CSCve10729, CSCve10771, CSCve10779, CSCve11521, CSCve11543."
    }
  ],
  "lastModified": "2026-06-17T01:03:12.667",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:webex_meeting_center:t29:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "17BA5D45-3F53-4D9A-8D5C-6ADEC17BE474"
            },
            {
              "criteria": "cpe:2.3:a:cisco:webex_meeting_center:t30:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5F6684FF-C2D7-440F-9FCF-9002F78A4CCD"
            },
            {
              "criteria": "cpe:2.3:a:cisco:webex_meeting_center:t31:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0F4B95A9-34C9-4C3D-B68C-A48E7A190EDF"
            },
            {
              "criteria": "cpe:2.3:a:cisco:webex_meeting_center:t32:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6C2F2F01-6B6B-4F77-95C6-4200325B2174"
            },
            {
              "criteria": "cpe:2.3:a:cisco:webex_meetings_server:2.6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F8745FD6-B0B3-46A9-9254-7B13877D7080"
            },
            {
              "criteria": "cpe:2.3:a:cisco:webex_meetings_server:2.7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "34C96C95-6BBA-4D4D-96E1-3102029905D6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}