Vulnerability Details : CVE-2009-2879
Heap-based buffer overflow in atas32.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 (aka T26SP49EP32) for Windows, 27.x before 27.10.x (aka T27SP10) for Windows, 26.x before 26.49.35 for Mac OS X and Linux, and 27.x before 27.11.8 for Mac OS X and Linux allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted WebEx Recording Format (WRF) file, a different vulnerability than CVE-2009-2876 and CVE-2009-2878.
Vulnerability category: OverflowExecute codeDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2009-2879
Probability of exploitation activity in the next 30 days: 2.48%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 89 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2009-2879
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Source |
---|---|---|---|---|---|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
nvd@nist.gov |
CWE ids for CVE-2009-2879
-
The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2009-2879
-
http://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=23040&signatureSubId=0&softwareVersion=6.0&releaseVersion=S456
Patch;Vendor Advisory
- http://www.fortiguard.com/advisory/FGA-2009-48.html
-
http://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=22662&signatureSubId=0&softwareVersion=6.0&releaseVersion=S456
Patch;Vendor Advisory
-
http://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=22661&signatureSubId=0&softwareVersion=6.0&releaseVersion=S456
Patch;Vendor Advisory
-
http://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=22660&signatureSubId=0&softwareVersion=6.0&releaseVersion=S456
Patch;Vendor Advisory
-
http://tools.cisco.com/security/center/viewAlert.x?alertId=19499
Patch;Vendor Advisory
- http://securitytracker.com/id?1023360
-
http://www.fortiguard.com/encyclopedia/vulnerability/cisco.webex.player.atas32.heap.overflow.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54841
-
http://www.vupen.com/english/advisories/2009/3574
Patch;Vendor Advisory
-
http://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=22799&signatureSubId=0&softwareVersion=6.0&releaseVersion=S456
Patch;Vendor Advisory
- http://www.securityfocus.com/bid/37352
-
http://www.cisco.com/en/US/products/products_security_advisory09186a0080b0a577.shtml
Patch;Vendor Advisory
-
http://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=22663&signatureSubId=0&softwareVersion=6.0&releaseVersion=S456
Patch;Vendor Advisory
Products affected by CVE-2009-2879
- cpe:2.3:a:cisco:webex:27.00:*:linux:*:*:*:*:*
- cpe:2.3:a:cisco:webex:26.00:*:linux:*:*:*:*:*
- cpe:2.3:a:cisco:webex:26.00:*:mac_os_x:*:*:*:*:*
- cpe:2.3:a:cisco:webex:27.00:*:mac_os_x:*:*:*:*:*
- cpe:2.3:a:cisco:webex:26.00:*:windows:*:*:*:*:*
- cpe:2.3:a:cisco:webex:27.00:*:windows:*:*:*:*:*