Specifically, there are concerns that attackers would be able to take advantage of the gap in its security if Cisco’s WebEx website was to suffer a cross-site scripting vulnerability.įor now, the best recourse is to ensure that all installations of the WebEx extension have been updated to version 1.0.3. Unfortunately, there are still some lingering worries about the security of the extension. Security researcher Martijn Grooten noted that the exploit could have caused chaos if it were combined with a ransomware attack, commenting on the situation in a report by Ars Technica. This particular vulnerability had the potential to be catastrophic, given that it targeted a service that’s commonly used in an enterprise setting.
Hi, I have been using the Webex Meeting desktop app for quite some time now.
Use the webex plugin for chrome on a mac mac os#
Malicious entities could run any code or command they liked on another user’s system, simply by having them visit a site that contained this string while using the Chrome browser with the WebEx extension running. Mac OS (Not Logged In): To disable Cisco Webex Meetings from starting up on. Ormandy found that this string could be used for much more than just initializing a WebEx session. This string simply needs to be included in the URL of a file or resource hosted by a website - it can even be tucked away in a HTML-based iframe tab, making it more difficult to detect. WebEx uses a 64-character string to remotely start a meeting on a PC with the extension installed. Ormandy is a member of Project Zero, a team assembled by Google to hunt down zero-day vulnerabilities. The issue was discovered by security researcher Tavis Ormandy, who alerted the company privately before publishing a blog post discussing the situation.
Users of the Cisco Systems WebEx extension are encouraged to make sure that they have updated to version 1.0.3. Fitbit Versa 3Ī Google Chrome browser extension with a user base of 20 million has been updated to patch a serious security vulnerability that made it possible to run malicious code with a minimum of effort.
0 kommentar(er)
