The vulnerability is due to a design defect in an application programing interface (API) response parser within the plugin. An attacker that can convince an affected user to visit an attacker-controlled web page or follow an attacker-supplied link with an affected browser could exploit the vulnerability. If successful, the attacker could execute arbitrary code with the privileges of the affected browser.
Cisco has released software updates for Google Chrome, Firefox, and Internet Explorer that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:
The following versions of the Cisco WebEx browser extensions are affected by the vulnerability described in this document:
Customers can determine which versions of the Cisco WebEx extensions are being utilized by following the steps listed below:
Cisco WebEx Extension for Google Chrome version 1.0.7 was released on January 26, 2017, and contains a fix for this vulnerability. Chrome users can ensure they are using the fixed version of the Cisco WebEx Extension for Google Chrome by doing the following:
The extension version is listed next to the Cisco WebEx Extension name.
The Cisco WebEx Extension for Google Chrome identification string, which organizations can use to identify hosts that contain the plugin, is the following:
Version 106 of the ActiveTouch General Plugin Container for Mozilla Firefox was released on January 28, 2017, and contains a fix for this vulnerability. Mozilla users can ensure they are using the fixed version of the ActiveTouch General Plugin Container for Mozilla by:
Microsoft Internet Explorer
Versions of the Cisco WebEx Plugin for Microsoft Internet Explorer were released on January 28, 2017, and contain a fix for this vulnerability. The registered name of the plugin in Internet Explorer may differ based on the installation method used for the plugin. The fixed version of the plugin depends on the version of Cisco WebEx that provided the update. The update may have been applied either via the web when joining a WebEx meeting or by a local update of the client via an MSI file. Internet Explorer users can ensure they are using the fixed version of the plugin for Internet Explorer by:
The version number is displayed at the bottom of the Manage Add-ons window. See the table of fixed plugin versions in the Fixed Software section of this advisory.
The Cisco WebEx ActiveX Plugin for Microsoft Internet Explorer Class ID (CLSID), which organizations can use to identify hosts that contain the plugin, is the following:
Cisco WebEx Productivity Tools are not affected by this vulnerability.
Cisco has confirmed that this vulnerability does not affect Cisco WebEx browser extensions for Mac or Linux, or Cisco WebEx on Microsoft Edge.
Customers who currently have web proxies or web gateways in their environment can create a URL filtering policy to block web requests matching the following condition:
URL requests containing the string pattern « cwcsf-nativemsg-iframe-43c85c0d-d633-af5e-c056-32dc7efc570b.html »
URL hostname not matching the known customer’s WebEx site URL (e.g. company.webex.com in https://company.webex.com/cwcsf-nativemsg-iframe-43c85c0d-d633-af5e-c056-32dc7efc570b.html)
Additionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades.
When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories and Alerts page, to determine exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to upgrade contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.