CVE-2018-15421 – Examining a Stack-based Overflow in the Cisco Webex Network Recording PlayerSeptember 27, 2018 | Ziad Badawi
Over this past year, several different researchers submitted bug reports in the Cisco Webex suite of programs. However, in their more than 40 submissions, they missed this trivial stack-based buffer overflow. This blog details ZDI-18-1078, a vulnerability in Cisco Webex Network Recording Player version 22.214.171.124 (now reaching its EOL) that results in remote code execution.
When reading an Advanced Recording (
.arf) file, the player attempts to access a file in the current directory named
RtpConfig.ini. This action is not documented. The
.ini file contains the configuration for what is likely a Real-Time Transport Protocol (RTP) service, but since there is no documentation of the file or the service, it may be something different.
The bug occurs in
nmvc.dll inside a routine labeled
sub_1001F479 that parses
RtpConfig.ini and extracts its properties. The following snippet shows how the
MinLostRate parameter is getting set up as well as other parameters going downwards.
The culprit here is a
sscanf call, a banned function by Microsoft, with no width field in the format string. The
sscanf function parses the
.ini file contents and reads property values in order to match them to a set of hardcoded parameters. The format used is:
%[^ \t#]%*[ \t]%[^ \t#]%n
which writes to three arguments. The first and third specifiers (
%[^ \t#]) do not use a width value in between the
[. This means it will read every character until it reaches whitespace. This will write to the passed arguments
Source disregarding their sizes and could lead to an overflow if input is large enough.
.ini file is read in 0x3FF-byte chunks and, since both consecutive variables
Str1 are sized
0x106 bytes respectively, an overflow can occur leading to a corrupted stack.
Cisco patched this and two other vulnerabilities with advisory cisco-sa-20180919-webex. It is good to know that these versions are reaching their EOL, as many similar bugs have been submitted to the program. Hopefully, the newer versions are more secure. Bug submissions in enterprise software are on the rise, putting this category just behind Desktop Application and SCADA submissions. Considering how many of these programs exist in enterprises, this trend will likely continue.