CVE-2018-15421 – Examining a Stack-based Overflow in the Cisco Webex Network Recording Player

September 27, 2018 | Ziad Badawi

Over this past year, several different researchers submitted bug reports in the Cisco Webex suite of programs. However, in their more than 40 submissions, they missed this trivial stack-based buffer overflow. This blog details ZDI-18-1078, a vulnerability in Cisco Webex Network Recording Player version 31.23.2.58 (now reaching its EOL) that results in remote code execution.

The Vulnerability

When reading an Advanced Recording (.arf) file, the player attempts to access a file in the current directory named RtpConfig.ini. This action is not documented. The .ini file contains the configuration for what is likely a Real-Time Transport Protocol (RTP) service, but since there is no documentation of the file or the service, it may be something different.

Process Monitor showing nbrplay.exe looking for RtpConfig.ini

The bug occurs in nmvc.dll inside a routine labeled sub_1001F479 that parses RtpConfig.ini and extracts its properties. The following snippet shows how the MinLostRate parameter is getting set up as well as other parameters going downwards.

Setting up different properties

The culprit here is a sscanf call, a banned function by Microsoft, with no width field in the format string. The sscanf function parses the .ini file contents and reads property values in order to match them to a set of hardcoded parameters. The format used is:

         %[^ \t#]%*[ \t]%[^ \t#]%n

which writes to three arguments. The first and third specifiers (%[^ \t#]) do not use a width value in between the % and [. This means it will read every character until it reaches whitespace. This will write to the passed arguments Str1 and Source disregarding their sizes and could lead to an overflow if input is large enough.

No width in format string

The .ini file is read in 0x3FF-byte chunks and, since both consecutive variables Source and Str1 are sized 0x100 and 0x106 bytes respectively, an overflow can occur leading to a corrupted stack.

Corrupted stack

Conclusion

Cisco patched this and two other vulnerabilities with advisory cisco-sa-20180919-webex. It is good to know that these versions are reaching their EOL, as many similar bugs have been submitted to the program. Hopefully, the newer versions are more secure. Bug submissions in enterprise software are on the rise, putting this category just behind Desktop Application and SCADA submissions. Considering how many of these programs exist in enterprises, this trend will likely continue.

You can find me on Twitter @ziadrb and follow the team for the latest exploit techniques and security patches.