CVE-2017-3823
published 2017-02-01CVE-2017-3823: An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Container before 106 on Mozilla Firefox, the…
PriorityP271high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EXPLOIT
EPSS
27.23%
97.8th percentile
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Container before 106 on Mozilla Firefox, the GpcContainer Class ActiveX control plugin before 10031.6.2017.0126 on Internet Explorer, and the Download Manager ActiveX control plugin before 2.1.0.10 on Internet Explorer. A vulnerability in these Cisco WebEx browser extensions could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the affected browser on an affected system. This vulnerability affects the browser extensions for Cisco WebEx Meetings Server and Cisco WebEx Centers (Meeting Center, Event Center, Training Center, and Support Center) when they are running on Microsoft Windows. The vulnerability is a design defect in an application programing interface (API) response parser within the extension. An attacker that can convince an affected user to visit an attacker-controlled web page or follow an attacker-supplied link with an affected browser could exploit the vulnerability. If successful, the attacker could execute arbitrary code with the privileges of the affected browser.
Affected
38 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | activetouch_general_plugin_container | — | — |
| cisco | download_manager | — | — |
| cisco | gpccontainer_class | <= 10031.6.2017.0125 | — |
| cisco | webex | <= 1.0.6 | — |
| cisco | webex_browser_extension | — | — |
| cisco | webex_meeting_center | — | — |
| cisco | webex_meeting_center | — | — |
| cisco | webex_meeting_center | — | — |
| cisco | webex_meeting_center | — | — |
| cisco | webex_meeting_center | — | — |
| cisco | webex_meeting_center | — | — |
| cisco | webex_meeting_center | — | — |
| cisco | webex_meeting_center | — | — |
| cisco | webex_meeting_center | — | — |
| cisco | webex_meeting_center | — | — |
| cisco | webex_meetings_server | — | — |
| cisco | webex_meetings_server | — | — |
| cisco | webex_meetings_server | — | — |
| cisco | webex_meetings_server | — | — |
| cisco | webex_meetings_server | — | — |
| cisco | webex_meetings_server | — | — |
| cisco | webex_meetings_server | — | — |
| cisco | webex_meetings_server | — | — |
| cisco | webex_meetings_server | — | — |
| cisco | webex_meetings_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit delivered via attacker-controlled web page or attacker-supplied link targeting affected Cisco WebEx browser extension users on Windows ↗
- →Vulnerability triggered through a design defect in the API response parser within the WebEx browser extension — monitor for anomalous API responses parsed by the extension ↗
- →Metasploit module available targeting Cisco WebEx Chrome Extension version 1.0.1 for arbitrary command execution — presence of this module in use indicates active exploitation attempts ↗
- ·Vulnerability affects Cisco WebEx Chrome Extension before version 1.0.7; ensure patched version is deployed ↗
- ·Vulnerability affects ActiveTouch General Plugin Container before version 106 on Mozilla Firefox ↗
- ·Vulnerability affects GpcContainer Class ActiveX control plugin before version 10031.6.2017.0126 on Internet Explorer ↗
- ·Vulnerability affects Download Manager ActiveX control plugin before version 2.1.0.10 on Internet Explorer ↗
- ·Vulnerability only affects systems running Microsoft Windows; non-Windows platforms are not impacted ↗
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_cisco8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-jvxg-m38c-9fg2: An issue was discovered in the Cisco WebEx Extension before 1
ghsa_unreviewed·2022-05-17
CVE-2017-3823 [HIGH] CWE-119 GHSA-jvxg-m38c-9fg2: An issue was discovered in the Cisco WebEx Extension before 1
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Container before 106 on Mozilla Firefox, the GpcContainer Class ActiveX control plugin before 10031.6.2017.0126 on Internet Explorer, and the Download Manager ActiveX control plugin before 2.1.0.10 on Internet Explorer. A vulnerability in these Cisco WebEx browser extensions could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the affected browser on an affected system. This vulnerability affects the browser extensions for Cisco WebEx Meetings Server and Cisco WebEx Centers (Meeting Center, Event Center, Training Center, and Support Center) when they are running on Microsoft Windows. The vulnerability is a design defect in an applica
Cisco
Cisco WebEx Browser Extension Remote Code Execution Vulnerability
vendor_cisco·2017-01-25·CVSS 8.8
CVE-2017-3823 [HIGH] CWE-119 Cisco WebEx Browser Extension Remote Code Execution Vulnerability
Cisco WebEx Browser Extension Remote Code Execution Vulnerability
A vulnerability in Cisco WebEx browser extensions could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the affected browser on an affected system. This vulnerability affects the browser extensions for Cisco WebEx Meetings Server and Cisco WebEx Centers (Meeting Center, Event Center, Training Center, and Support Center) when they are running on Microsoft Windows.
The vulnerability is due to a design defect in an application programing interface (API) response parser within the plugin. An attacker that can convince an affected user to visit an attacker-controlled web page or follow an attacker-supplied link with an affected browser could exploit the vulnerability. If successful, t
Cisco
Cisco WebEx Browser Extension Remote Code Execution Vulnerability
vendor_cisco·CVSS 3.0
CVE-2017-3823 Cisco WebEx Browser Extension Remote Code Execution Vulnerability
CVE-2017-3823: Cisco WebEx Browser Extension Remote Code Execution Vulnerability
A vulnerability in Cisco WebEx browser extensions could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the affected browser on an affected system. This vulnerability affects the browser extensions for Cisco WebEx Meetings Server and Cisco WebEx Centers (Meeting Center, Event Center, Training Center, and Support Center) when they are running on Microsoft Windows. The vulnerability is due to a design defect in an application programing interface (API) response parser within the plugin. An attacker that can convince an affected user to visit an attacker-controlled web page or follow an attacker-supplied link with an affected browser could exploit the vulnerability. If s
No detection rules found.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/95737http://www.securitytracker.com/id/1037680https://0patch.blogspot.com/2017/01/micropatching-remote-code-execution-in.htmlhttps://blog.filippo.io/webex-extension-vulnerability/https://bugs.chromium.org/p/project-zero/issues/detail?id=1096https://bugs.chromium.org/p/project-zero/issues/detail?id=1100https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170124-webexhttps://www.kb.cert.org/vuls/id/909240http://www.securityfocus.com/bid/95737http://www.securitytracker.com/id/1037680https://0patch.blogspot.com/2017/01/micropatching-remote-code-execution-in.htmlhttps://blog.filippo.io/webex-extension-vulnerability/https://bugs.chromium.org/p/project-zero/issues/detail?id=1096https://bugs.chromium.org/p/project-zero/issues/detail?id=1100https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170124-webexhttps://www.kb.cert.org/vuls/id/909240
2017-02-01
Published