{
  "document": {
    "acknowledgments": [
      {
        "summary": "Cisco would like to thank Simon Zuckerbraun, working with Trend Micro\u0027s Zero Day Initiative (ZDI), for reporting this vulnerability.\r\n\r\nCisco would also like to thank Ben Cheney of DXC Technology and Ron Bowes and Jeff McJunkin of Counter Hack for independently reporting this vulnerability."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "notes": [
      {
        "category": "summary",
        "text": "A vulnerability in the folder permissions of Cisco Webex Meetings client for Windows could allow an authenticated, local attacker to modify locally stored files and execute code on a targeted device with the privilege level of the user.\r\n\r\nThe vulnerability is due to folder permissions that grant a user the permission to read, write, and execute files in the Webex folders. An attacker could exploit this vulnerability to write malicious files to the Webex client directory, affecting all other users of the targeted device. A successful exploit could allow a user to execute commands with elevated privileges.\r\n\r\nAttacks on single-user systems are less likely to occur, as the attack must be carried out by the user on the user\u0027s own system. Multiuser systems have a higher risk of exploitation because folder permissions have an impact on all users of the device. For an attacker to exploit this vulnerability successfully, a second user must execute the locally installed malicious file to allow remote code execution to occur.\r\n\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\r\n\r\nThis advisory is available at the following link:\r\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-webex-pe [\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-webex-pe\"]",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "This vulnerability affects client applications installed from the following Cisco Webex Meetings products when running on Microsoft Windows end-user systems:\r\n\r\nCisco Webex Meetings Suite (WBS31)\r\nCisco Webex Meetings Suite (WBS32)\r\nCisco Webex Meetings Suite (WBS33)\r\nCisco Webex Meetings\r\nCisco Webex Meetings Server\r\n\r\nTo determine whether a Cisco Webex meeting site is running an affected version of the Webex software, users can log in to their Cisco Webex meeting site and go to Support \u003e Downloads. The version of the Webex software will be displayed on the right side of the page under About Meeting Center. See the Fixed Software [\"#fs\"] section of this advisory for details.\r\n\r\nAlternatively, version information for the Cisco Webex meeting client can be accessed directly in the client. Version information for the Cisco Webex meeting client on Windows platforms can be viewed by choosing Help \u003e About Cisco Webex Meeting Center.\r\n\r\nNote: Customers who do not receive automatic software updates may be running versions of Cisco Webex Meetings that have reached end of software maintenance and should contact the Cisco TAC (Technical Assistance Center).",
        "title": "Vulnerable Products"
      },
      {
        "category": "general",
        "text": "Only products listed in the Vulnerable Products [\"#vp\"] section of this advisory are known to be affected by this vulnerability.\r\n\r\nCisco has confirmed that this vulnerability does not affect Cisco Webex Meetings client applications running on Mac OS X and Linux operating systems.",
        "title": "Products Confirmed Not Vulnerable"
      },
      {
        "category": "general",
        "text": "There are no workarounds that address this vulnerability.",
        "title": "Workarounds"
      },
      {
        "category": "general",
        "text": "Cisco will release free software updates that address the vulnerability described in this advisory. Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license:\r\nhttps://www.cisco.com/c/en/us/products/end-user-license-agreement.html [\"https://www.cisco.com/c/en/us/products/end-user-license-agreement.html\"]\r\n\r\nAdditionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades.\r\n\r\nWhen considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories and Alerts page [\"https://www.cisco.com/go/psirt\"], to determine exposure and a complete upgrade solution.\r\n\r\nIn all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.\r\n  Customers Without Service Contracts\r\nCustomers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC:\r\nhttps://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html [\"https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html\"]\r\n\r\nCustomers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.\r\n  Fixed Releases\r\nCisco has released new desktop applications to remediate this vulnerability. Users must have the new desktop applications installed to remediate the vulnerability.\r\n\r\nUsers can obtain the installable MSI from their upgraded site. For WBS33, the applications are automatically delivered and installed automatically when administrative users attend a meeting on a WBS33 site.\r\n\r\nUsers without administrative rights will not be able to install the update automatically and will require administrators to install the application installable MSI on their desktops.\r\n\r\nDue to customers\u2019 lock down status of WBS 32, users or IT administrators must install the desktop applications manually.\r\n\r\nUsers or IT administrators can contact the Cisco TAC to obtain the desktop applications\u2019 installable MSI prior to their site\u2019s upgrade.\r\n\r\nCustomers\u2019 sites are being upgraded to make this desktop application available to users according to the following schedule:\r\n\r\nWebex Major Release\r\n\r\nFirst Fixed Release\r\n\r\nAvailability\r\n\r\nCisco Webex Meetings Suite (WBS31)\r\n\r\nN/A\r\n\r\nCisco will not release a new desktop application for WBS31 releases. Customers must upgrade to WBS32 or WBS33 and install the appropriate update.\r\n\r\nCisco Webex Meetings Suite (WBS32)\r\n\r\nWBS32.15.20\r\n\r\nReleased\r\n\r\nSee WBS 32.15.20 availability on your site based on your cluster schedule: https://status.webex.com/#/maintenance/calendar\r\n\r\nEnd users or IT administrators must install new desktop applications manually to remediate the vulnerability.\r\n\r\nContact the Cisco TAC to obtain desktop applications\u2019 installable MSI prior to availability on your site.\r\n\r\nCisco Webex Meetings Suite (WBS33)\r\n\r\nWBS33.4\r\n\r\nReleased\r\n\r\nSee WBS33.4 availability on your site based on your cluster schedule: https://status.webex.com/#/maintenance/calendar\r\n\r\nUsers with administrative rights on their desktops will automatically receive a Windows User Account Control (UAC) pop-up window after they join or start a meeting on an updated WBS33.4 site. Users must accept this UAC request to remediate the vulnerability.\r\n\r\nUsers without administrative rights will not be able to install the update automatically and will require administrators to install the application installable MSI on their desktops.\r\n\r\nContact the Cisco TAC to obtain the desktop applications\u2019 installable MSI prior to availability on your site.\r\n\r\nNote that the WBS33.4 installable MSI installs the new Webex Desktop application, which includes the new Outlook plug-in and replaces the older Productivity Tools. Although replacement of Productivity Tools with the new desktop application is highly recommended, please contact the Cisco TAC if this replacement is not desired.\r\n\r\nCisco Webex Meetings\r\n\r\n1.3.37\r\n\r\nAvailable beginning September 14, 2018\r\n\r\nContact the Cisco TAC to obtain the desktop applications\u2019 installable MSI prior to availability on the site.\r\n\r\nCisco Webex Meetings Server\r\n\r\n3.0MR2\r\n\r\nReleased\r\n\r\nThe software is available for download from the Software Center [\"https://software.cisco.com/download/home\"] on Cisco.com by clicking Browse all and navigating to Conferencing \u003e Web Conferencing \u003e Webex Meetings Server \u003e Webex Meetings Server 3.0 or via direct link [\"https://software.cisco.com/download/home/286312005/type\"].\r\n\r\nFixed software will be available on customers\u2019 sites based on the release update schedule. Customers will receive a separate communication with the update schedule for their site. Customers can also contact the Cisco TAC to determine their site\u2019s update schedule.\r\n\r\nTo determine whether a meeting site has an updated  version of the Cisco Webex software, users can sign in to their Cisco  Webex Meetings site and go to the Support \u003e Downloads section. The version is displayed on the right side of the page under About Webex Meetings.",
        "title": "Fixed Software"
      },
      {
        "category": "general",
        "text": "To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html\"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.",
        "title": "Vulnerability Policy"
      },
      {
        "category": "general",
        "text": "The Cisco Product Security Incident Response Team (PSIRT) is aware of public announcements of the vulnerability. However, there has been no indication of malicious use of the vulnerability that is described in this advisory.",
        "title": "Exploitation and Public Announcements"
      },
      {
        "category": "general",
        "text": "Cisco would like to thank Simon Zuckerbraun, working with Trend Micro\u0027s Zero Day Initiative (ZDI), for reporting this vulnerability.\r\n\r\nCisco would also like to thank Ben Cheney of DXC Technology and Ron Bowes and Jeff McJunkin of Counter Hack for independently reporting this vulnerability.",
        "title": "Source"
      },
      {
        "category": "legal_disclaimer",
        "text": "THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.\r\n\r\nA standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.",
        "title": "Legal Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "Emergency Support:\r\n+1 877 228 7302 (toll-free within North America)\r\n+1 408 525 6532 (International direct-dial)\r\nNon-emergency Support:\r\nEmail: psirt@cisco.com\r\nSupport requests that are received via e-mail are typically acknowledged within 48 hours.",
      "issuing_authority": "Cisco product security incident response is the responsibility of the Cisco Product Security Incident Response Team (PSIRT). The Cisco PSIRT is a dedicated, global team that manages the receipt, investigation, and public reporting of security vulnerability information that is related to Cisco products and networks. The on-call Cisco PSIRT works 24x7 with Cisco customers, independent security researchers, consultants, industry organizations, and other vendors to identify possible security issues with Cisco products and networks.\r\nMore information can be found in Cisco Security Vulnerability Policy available at https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html",
      "name": "Cisco",
      "namespace": "https://wwww.cisco.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Cisco Webex Meetings Client for Windows Privilege Escalation Vulnerability",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-webex-pe"
      },
      {
        "category": "external",
        "summary": "Cisco Security Vulnerability Policy",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
      },
      {
        "category": "external",
        "summary": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-webex-pe",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-webex-pe"
      },
      {
        "category": "external",
        "summary": "https://www.cisco.com/c/en/us/products/end-user-license-agreement.html",
        "url": "https://www.cisco.com/c/en/us/products/end-user-license-agreement.html"
      },
      {
        "category": "external",
        "summary": "Cisco Security Advisories and Alerts page",
        "url": "https://www.cisco.com/go/psirt"
      },
      {
        "category": "external",
        "summary": "https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html",
        "url": "https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html"
      },
      {
        "category": "external",
        "summary": "Software Center",
        "url": "https://software.cisco.com/download/home"
      },
      {
        "category": "external",
        "summary": "direct link",
        "url": "https://software.cisco.com/download/home/286312005/type"
      },
      {
        "category": "external",
        "summary": "Security Vulnerability Policy",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
      }
    ],
    "title": "Cisco Webex Meetings Client for Windows Privilege Escalation Vulnerability",
    "tracking": {
      "current_release_date": "2018-09-26T13:34:00+00:00",
      "generator": {
        "date": "2022-09-03T03:08:24+00:00",
        "engine": {
          "name": "TVCE"
        }
      },
      "id": "cisco-sa-20180905-webex-pe",
      "initial_release_date": "2018-09-05T16:00:00+00:00",
      "revision_history": [
        {
          "date": "2018-09-05T15:59:18+00:00",
          "number": "1.0.0",
          "summary": "Initial public release."
        },
        {
          "date": "2018-09-26T13:30:19+00:00",
          "number": "1.1.0",
          "summary": "Added Cisco bug CSCvk70822. Cited additional sources."
        }
      ],
      "status": "final",
      "version": "1.1.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_family",
            "name": "Cisco WebEx Meeting Center",
            "product": {
              "name": "Cisco WebEx Meeting Center ",
              "product_id": "CSAFPID-97151"
            }
          },
          {
            "category": "product_family",
            "name": "Cisco WebEx Meetings Server",
            "product": {
              "name": "Cisco WebEx Meetings Server ",
              "product_id": "CSAFPID-190702"
            }
          },
          {
            "category": "product_family",
            "name": "Cisco Webex Meetings",
            "product": {
              "name": "Cisco Webex Meetings ",
              "product_id": "CSAFPID-228295"
            }
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-0422",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCvh89155"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCvh89157"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCvk70822"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCvh89158"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-97151",
          "CSAFPID-190702",
          "CSAFPID-228295"
        ]
      },
      "release_date": "2018-09-05T16:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-190702",
            "CSAFPID-97151",
            "CSAFPID-228295"
          ],
          "url": "https://software.cisco.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-97151",
            "CSAFPID-190702",
            "CSAFPID-228295"
          ]
        }
      ],
      "title": "Cisco Webex Meetings Client for Windows Privilege Escalation Vulnerability"
    }
  ]
}