Info

Disclosure

Jul 06, 2006

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

WebEx Downloader plug-in contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the ActiveX control installed by WebEx not properly sanitizing user input supplied to the the "GpcUrlRoot" and "GpcIniFileName" variables. This may allow an attacker to include a DLL file from a remote host that contains arbitrary commands which will be executed by the vulnerable object under the security context of the user viewing the web page.

Classification

Location: Remote / Network Access, Context Dependent
Attack Type: Input Manipulation, Other
Impact: Loss of Integrity, Impact Unknown
Exploit: Exploit Private
Disclosure: OSVDB Verified, Vendor Verified

Solution

Upgrade to version SP30 (see Vendor Specific Solution URL) or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

WebEx Communications, Inc.

WebEx Downloader plug-in

2.x

References

Keyword: #WEBX-06-1-1
CVE ID: 2006-3424 (see also: NVD)
Secunia Advisory ID: 20956
Related OSVDB ID: 27039
VUPEN Advisory: ADV-2006-2688
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-07/0076.html
Vendor Specific Solution URL: http://www.webex.com/go/downloadSP30
Vendor Specific News/Changelog Entry: http://www.webex.com/lp/security/ActiveAdv.html?TrackID=123456
Other Advisory URL: http://www.zerodayinitiative.com/advisories/ZDI-06-021.html
http://xforce.iss.net/xforce/alerts/id/226

Credit

David Dewey - ISS X-Force
Mark Dowd - Avertavertlabs.com - McAfee Avert(tm) Labs

Direct URL: http://osvdb.org/27040