Cisco WebEx .wrf Memory Corruption Vulnerabilty

1. Advisory Information

Title: Cisco WebEx .wrf Memory Corruption Vulnerabilty
Advisory ID: CORE-2012-0613
Advisory URL:
Date published: 2012-10-11
Date of last update: 2012-09-13
Vendors contacted: Cisco
Release mode: Coordinated release

2. Vulnerability Information

Class: Access of Memory Location After End of Buffer [CWE-788]
Impact: Code execution
Remotely Exploitable: No
Locally Exploitable: Yes
CVE Name: CVE-2012-3939


3. Vulnerability Description

A vulnerability exists in atas32.dll affecting Cisco WebEx Player v3.26 that allows an attacker to corrupt memory, which may lead to code execution in the context of the currently logged on user.

4. Vulnerable packages

  • Cisco WebEx Player v3.26
  • Cisco Meeting Center and older versions of WebEx Player are probably affected too, but they were not checked.

5. Vendor Information, Solutions and Workarounds

If the Cisco WebEx WRF Player was automatically installed, it will be automatically upgraded to the latest, nonvulnerable version when users access a recording file that is hosted on a WebEx meeting site. A non-vulnerable version of Cisco WebEx Player should be available at

6. Credits

This vulnerability was discovered and researched by Oren Isacson. The publication of this advisory was coordinated by Fernando Russ.


7. Technical Description / Proof of Concept

The memory corruption is caused by a call to the memcpy function with an invalid destination parameter.

In our proof of concept (POC), the destination parameter to the memcpy function points to unmapped memory. The source parameters points to valid heap memory. The size parameter is equal to 540. As the destination parameter is close to the top of the heap, and the source parameter points to data that may be user-controlled, this vulnerability may be leveraged to execute code.

8. Report Timeline

  • 2012-06-21: Core Security Technologies notifies Cisco Product Security Incident Response Team of the vulnerability, including a brief description of the issue.
  • 2012-06-21: Cisco PSIRT acknowledges the receipt of the information. Vendor asks for detailed technical information.
  • 2012-06-21: Core sends a draft version of the advisory and a PoC .wrf file which reproduce the issue.
  • 2012-06-25: Cisco PSIRT asks for more information regarding the exact version of the atas32.dll libary version.
  • 2012-06-25: Core sends the requested information.
  • 2012-07-11: Core notifies that the tentative publication deadline was missed and reschedule the publication for August 6th, 2012.
  • 2012-07-12: Cisco PSIRT asks if the advisory publication can be hold until they have finished its fixes.
  • 2012-07-12: Core notifies that the current publication date is tentative and can be moved while the new publication date keeps reasonable.
  • 2012-07-16: Cisco PSIRT informs that they can't be sure of having fixes sooner that beginning of September.
  • 2012-07-17: Core acknowledges the new timeframe for the publication and asks for a more specific date.
  • 2012-07-20: Cisco PSIRT informs that the new publication date for the fixes and all the related information regarding this vulnerability is September 12th, 2012.
  • 2012-07-23: Core Security Technologies acknowledges the new deadline for the publication.
  • 2012-08-23: Cisco PSIRT asks to postpone the publication date to October 10th, 2012.
  • 2012-08-27: Core acknowledges the new deadline for the publication.
  • 2012-09-12: Publication date confirmed on [2012-07-20] missed.
  • 2012-10-11: Advisory CORE-2012-0613 published.

9. About CoreLabs

CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at:

10. About Core Security Technologies

Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations.

Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at:

11. Disclaimer

The contents of this advisory are copyright (c) 2012 Core Security Technologies and (c) 2012 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License:

12. PGP/GPG Keys

This advisory has been signed with the GPG key of Core Security Technologies advisories team.