Cisco’s Webex Browser Extension contain a critical bug that can open up customers’ entire computers to remote code execution attacks if the browsers visit websites containing specially crafted malicious code.
The company says it is in the process of correcting the problem, and has apparently made a few initial steps toward a permanent fix. It says there is no workaround available.
The flaw allows websites containing a certain code pattern to open a WebEx session to the browser and “to execute arbitrary code on the affected system, which could be used to conduct further attacks,” according to a .
The advisory says it has begun to issue software updates to address the problem, but so far the process is not complete.
The best thing to do is remove WebEx software from Windows machines by using the removal tool found . If it’s necessary to join WebEx meetings, users can do so via Microsoft Edge, which is not vulnerable to the attack.
Customers should monitor the Cisco Advisories and Alerts page to keep abreast of the latest fixes for this problem.
three days ago by Tavis Ormandy of Google’s Project Zero bug-hunting team. He says that a “magic patten” – cwcsf- nativemsg-iframe-43c85c0d-d633-af5e-c056-32dc7efc570b.html – contained in a Web site enables it to open a connection to the browser extension. And, he says, “this magic string is enough for any website to execute arbitrary code.”
This story, “Cisco scrambling to fix a remote code execution problem in WebEx” was originally published by