CVE-2019-1636
published 2019-01-23CVE-2019-1636: A vulnerability in the Cisco Webex Teams client, formerly Cisco Spark, could allow an attacker to execute arbitrary commands on a targeted system. This…
PriorityP262high7.8CVSS 3.0
AVLACLPRNUIRSUCHIHAH
EXPLOIT
EPSS
46.89%
98.7th percentile
A vulnerability in the Cisco Webex Teams client, formerly Cisco Spark, could allow an attacker to execute arbitrary commands on a targeted system. This vulnerability is due to unsafe search paths used by the application URI that is defined in Windows operating systems. An attacker could exploit this vulnerability by convincing a targeted user to follow a malicious link. Successful exploitation could cause the application to load libraries from the directory targeted by the URI link. The attacker could use this behavior to execute arbitrary commands on the system with the privileges of the targeted user if the attacker can place a crafted library in a directory that is accessible to the vulnerable system.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_webex_teams | — | — |
| cisco | webex_teams | — | — |
| cisco | webex_teams_uri_handler | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for processes launched with Qt argument '-platformpluginpath' pointing to a UNC/remote Windows share path, which is the mechanism used to load a malicious DLL remotely. ↗
- →Detect .URL shortcut files containing custom URI schemes (e.g., 'origin://') with injected arguments (special characters like '"', spaces, '-', '/') in the URL= field, as these bypass browser argument encoding protections. ↗
- →Alert on DLL loads from UNC paths (\\server\share\...) by Webex Teams / Cisco Spark or other Qt-based application processes, indicating potential insecure library loading via URI handler. ↗
- →Monitor for iframe or HTML content invoking custom URI schemes (e.g., 'origin://') with argument injection patterns, particularly when opened in Internet Explorer or legacy browsers that do not encode special characters. ↗
- ·The .URL file attack vector bypasses modern browser protections (including Edge smart-scan) and works on fully updated Windows 10, making it a higher-risk delivery mechanism requiring social engineering. ↗
- ·The attacker-controlled Windows share hosting the malicious DLL must contain a subdirectory matching a valid Qt plugin directory name (e.g., 'imageformats') for the DLL to be loaded by the Qt application. ↗
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_cisco7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Webex Teams URI Handler Insecure Library Loading Vulnerability
vendor_cisco·2019-01-23·CVSS 7.8
CVE-2019-1636 [HIGH] CWE-78 Cisco Webex Teams URI Handler Insecure Library Loading Vulnerability
Cisco Webex Teams URI Handler Insecure Library Loading Vulnerability
A vulnerability in the Cisco Webex Teams client, formerly Cisco Spark, could allow an attacker to execute arbitrary commands on a targeted system.
This vulnerability is due to unsafe search paths used by the application URI that is defined in Windows operating systems. An attacker could exploit this vulnerability by convincing a targeted user to follow a malicious link. Successful exploitation could cause the application to load libraries from the directory targeted by the URI link. The attacker could use this behavior to execute arbitrary commands on the system with the privileges of the targeted user if the attacker can place a crafted library in a directory that is accessible to the vulnerable system.
Cisco has releas
Cisco
Cisco Webex Teams URI Handler Insecure Library Loading Vulnerability
vendor_cisco·CVSS 3.0
CVE-2019-1636 Cisco Webex Teams URI Handler Insecure Library Loading Vulnerability
CVE-2019-1636: Cisco Webex Teams URI Handler Insecure Library Loading Vulnerability
A vulnerability in the Cisco Webex Teams client, formerly Cisco Spark, could allow an attacker to execute arbitrary commands on a targeted system. This vulnerability is due to unsafe search paths used by the application URI that is defined in Windows operating systems. An attacker could exploit this vulnerability by convincing a targeted user to follow a malicious link. Successful exploitation could cause the application to load libraries from the directory targeted by the URI link. The attacker could use this behavior to execute arbitrary commands on the system with the privileges of the targeted user if the attacker can place a crafted library in a directory that is accessible to the vulnerable system. Ci
GHSA
GHSA-wrf3-rqxm-457j: A vulnerability in the Cisco Webex Teams client, formerly Cisco Spark, could allow an attacker to execute arbitrary commands on a targeted system
ghsa_unreviewed·2022-05-13
CVE-2019-1636 [HIGH] CWE-78 GHSA-wrf3-rqxm-457j: A vulnerability in the Cisco Webex Teams client, formerly Cisco Spark, could allow an attacker to execute arbitrary commands on a targeted system
A vulnerability in the Cisco Webex Teams client, formerly Cisco Spark, could allow an attacker to execute arbitrary commands on a targeted system. This vulnerability is due to unsafe search paths used by the application URI that is defined in Windows operating systems. An attacker could exploit this vulnerability by convincing a targeted user to follow a malicious link. Successful exploitation could cause the application to load libraries from the directory targeted by the URI link. The attacker could use this behavior to execute arbitrary commands on the system with the privileges of the targeted user if the attacker can place a crafted library in a directory that is accessible to the vulnerable system.
Kernel
powerpc/tm: Fix oops on sigreturn on systems without TM
kernel_security·2019-07-19
CVE-2019-13648 powerpc/tm: Fix oops on sigreturn on systems without TM
powerpc/tm: Fix oops on sigreturn on systems without TM
On systems like P9 powernv where we have no TM (or P8 booted with
ppc_tm=off), userspace can construct a signal context which still has
the MSR TS bits set. The kernel tries to restore this context which
results in the following crash:
Unexpected TM Bad Thing exception at c0000000000022fc (msr 0x8000000102a03031) tm_scratch=800000020280f033
Oops: Unrecoverable exception, sig: 6 [#1]
LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
Modules linked in:
CPU: 0 PID: 1636 Comm: sigfuz Not tainted 5.2.0-11043-g0a8ad0ffa4 #69
NIP: c0000000000022fc LR: 00007fffb2d67e48 CTR: 0000000000000000
REGS: c00000003fffbd70 TRAP: 0700 Not tainted (5.2.0-11045-g7142b497d8)
MSR: 8000000102a03031 CR: 42004242 XER: 00000000
CFAR: c0000000000022e0 IR
No detection rules found.
No writeups or analysis indexed.
2019-01-23
Published