September 2, 2024
Proactive Defense: The Importance of Incident Response Planning in Cybersecurity
Rewterz Threat Alert -WARZONE RAT ( aka Ave Maria RAT) Malware
February 27, 2019
Rewterz Threat Alert – Threat Indicators – Malspam: Loki Bot Malware
February 28, 2019
Rewterz Threat Alert -WARZONE RAT ( aka Ave Maria RAT) Malware
February 27, 2019
Rewterz Threat Alert – Threat Indicators – Malspam: Loki Bot Malware
February 28, 2019
Severity: Medium
Analysis Summary
The vulnerability is an OS Command Injection described it as a “bypass to avoid the new controls” put in place by Cisco after patching a previously found a DLL hijacking issue in the same application.
The vulnerability stems from the inability of the Cisco Webex Meetings Desktop App’s update service to properly validate version numbers of new files. So, an unprivileged local attacker could exploit this vulnerability by invoking the update service command with a crafted argument and folder.
A potential attacker could exploit this software flaw by replacing the Cisco Webex Meetings update binary with a “previous vulnerable version through a fake update (the service uses an XML to check which files can be installed) that will load a malicious DLL,” leading to privilege escalation and allowing the actor to run arbitrary commands with SYSTEM user privileges.
Impact
- Run arbitrary commands
- System user privileges
Affected Products
All versions of Cisco WebEx Meetings Desktop App releases between 33.6.4.15 and 33.8.2.7
Remediation
This vulnerability can be exploited remotely by leveraging the operating system and remote management tools, so the administrators should be aware of the active directory deployments.