[c-nsp] Cisco Security Advisory: Multiple Vulnerabilities in the Cisco WebEx Recording Format Player

[Cisco Systems Product Security Incident Response Team]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Multiple Vulnerabilities in the Cisco WebEx Recording Format Player

Advisory ID: cisco-sa-20121010-webex

Revision 1.0

For Public Release 2012 October 10 16:00  UTC (GMT)
- ----------------------------------------------------------------------

Summary
=======

The Cisco WebEx Recording Format (WRF) player contains six buffer
overflow vulnerabilities. In some cases, exploitation of the
vulnerabilities could allow a remote attacker to execute arbitrary
code on the system with the privileges of a targeted user. 

The Cisco WebEx WRF Player is an application used to play back WRF
WebEx meeting recordings that have been recorded on a WebEx meeting
site or on the computer of an online meeting attendee. The Cisco WebEx
WRF Player can be automatically installed when the user accesses a
recording file that is hosted on a WebEx meeting site. The Cisco WebEx
WRF Player can also be manually installed for offline playback after
downloading the application from:
http://www.webex.com/play-webex-recording.html.

If the Cisco WebEx WRF Player was automatically installed, it will be
automatically upgraded to the latest, nonvulnerable version when users
access a recording file that is hosted on a WebEx meeting site. If the
Cisco WebEx WRF Player was manually installed, users will need to
manually install a new version of the Cisco WebEx WRF Player after
downloading the latest version from:
http://www.webex.com/play-webex-recording.html.

Cisco has updated affected versions of the WebEx meeting sites and
Cisco WebEx WRF Player to address these vulnerabilities. 

This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121010-webex

-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.18 (Darwin)
Comment: GPGTools - http://gpgtools.org

iF4EAREIAAYFAlB1h6AACgkQUddfH3/BbTrjWAD/Xo3bSaXFymHXWKgoGNJQTRcp
MFilgSgS+0Hp09ncDC0A/R+0E3BmJFwMukJw6IPAQkp+AjYus1naLVDcQMjh7svJ
=tuKg
-----END PGP SIGNATURE-----