|
|
Info |
Last Modified |
| 10 months ago |
|
|
|
|
Description |
WebEx Downloader plug-in contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the ActiveX control installed by WebEx not properly sanitizing user input supplied to the the "GpcUrlRoot" and "GpcIniFileName" variables. This may allow an attacker to include a DLL file from a remote host that contains arbitrary commands which will be executed by the vulnerable object under the security context of the user viewing the web page.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Input Manipulation,
Other
Impact:
Unknown
Exploit:
Exploit Unavailable
Disclosure:
OSVDB Verified
|
|
Solution |
Upgrade to version SP30 (see Vendor Specific Solution URL) or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
|
|
Products |
|
WebEx Downloader plug-in
 |
2.x |
|
|
|
|
Credit |
- David Dewey - ISS X-Force
- Mark Dowd - Avert
 avertlabs.com - McAfee Avert(tm) Labs
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
