CVE-2018-15421 – Examining a Stack-based Overflow in the Cisco Webex Network Recording Player

When reading an Advanced Recording (.arf) file, the player attempts to access a file in the current directory named RtpConfig.ini. This action is not documented. The .ini file contains the configuration for what is likely a Real-Time Transport Protocol (RTP) service, but since there is no documentation of the file or the service, it may be something different.

The bug occurs in nmvc.dll inside a routine labeled sub_1001F479 that parses RtpConfig.ini and extracts its properties. The following snippet shows how the MinLostRate parameter is getting set up as well as other parameters going downwards.

The culprit here is a sscanf call, a banned function by Microsoft, with no width field in the format string. The sscanf function parses the .ini file contents and reads property values in order to match them to a set of hardcoded parameters. The format used is:

         %[^ \t#]%*[ \t]%[^ \t#]%n

which writes to three arguments. The first and third specifiers (%[^ \t#]) do not use a width value in between the % and [. This means it will read every character until it reaches whitespace. This will write to the passed arguments Str1 and Source disregarding their sizes and could lead to an overflow if input is large enough.

The .ini file is read in 0x3FF-byte chunks and, since both consecutive variables Source and Str1 are sized 0x100 and 0x106 bytes respectively, an overflow can occur leading to a corrupted stack.