OSVDB ID: 27039

Title: WebEx Downloader Plug-in ActiveX/Java Source Subversion Arbitrary Program Execution

Info

Disclosure

Jul 06, 2006

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

WebEx Downloader plug-in contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the ActiveX control installed by WebEx not properly sanitizing user input supplied to the the "GpcUrlRoot" and "GpcIniFileName" variables. This may allow an attacker to include a DLL file from a remote host that contains arbitrary commands which will be executed by the vulnerable object under the security context of the user viewing the web page.

Classification

Location: Remote / Network Access, Context Dependent
Attack Type: Input Manipulation
Impact: Impact Unknown
Exploit: Exploit Public, Exploit Private
Disclosure: OSVDB Verified, Vendor Verified

Solution

Upgrade to version SP30 (See Vendor Solution URL) or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

WebEx Communications, Inc.

WebEx Downloader plug-in

2.0.0.7

References

Security Tracker: 1016446
Bugtraq ID: 18860
CVE ID: 2006-3423 (see also: NVD)
Secunia Advisory ID: 20956
ISS X-Force ID: 24370
Related OSVDB ID: 27040
VUPEN Advisory: ADV-2006-2688
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-07/0076.html
http://archives.neohapsis.com/archives/fulldisclosure/2006-07/0116.html
Vendor Specific Solution URL: http://www.webex.com/go/downloadSP30
Vendor Specific News/Changelog Entry: http://www.webex.com/lp/security/ActiveAdv.html?TrackID=123456
Other Advisory URL: http://www.zerodayinitiative.com/advisories/ZDI-06-021.html
Keyword: ZDI-06-021,#WEBX-06-1-1

Credit

David Dewey - ISS X-Force
Mark Dowd - Avertavertlabs.com - McAfee Avert(tm) Labs

Direct URL: http://osvdb.org/27039