Find All Outdated Cisco Webex Network Recording Player and Webex Player Installations
Cisco has released some new advisories regarding some of their WebEx software package. Specifically, the Cisco Webex Network Recording Player and Webex Player which have vulnerabilities in them. Luckily the main application seems to be spared, but if you have any of these additional components, it is important to update the software. You can find more information on the specific vulnerabilities in the Webex Player vulnerability blog post.
To check if you have these components installed somewhere in your network, you can run the report below.
Network Recording Player and Webex Player Audit Query
Select Distinct Top 1000000 tblAssets.AssetID,
tblAssets.AssetName,
tblAssets.Domain,
tblAssets.Username,
tblAssets.Userdomain,
Coalesce(tsysOS.Image, tsysAssetTypes.AssetTypeIcon10) As icon,
tblAssets.IPAddress,
tsysIPLocations.IPLocation,
tblAssetCustom.Manufacturer,
tblAssetCustom.Model,
tblOperatingsystem.Caption As OS,
tblSoftwareuni.softwareName,
tblSoftware.softwareVersion,
Case
When tblSoftwareuni.softwareName Like '%Network Recording Player%'
And Cast(ParseName(tblSoftware.softwareVersion, 4) As bigint) = 41 And
Cast(ParseName(tblSoftware.softwareVersion, 3) As bigint) >= 4 Then 'Safe'
When tblSoftwareuni.softwareName Like '%Network Recording Player%'
And Cast(ParseName(tblSoftware.softwareVersion, 4) As bigint) > 41 Then
'Safe'
When tblSoftwareuni.softwareName Like '%Network Recording Player%'
Then 'Vulnerable'
When tblSoftwareuni.softwareName Like '%WebEx Recorder and Player%' And
Cast(ParseName(tblSoftware.softwareVersion, 4) As bigint) = 41 And
Cast(ParseName(tblSoftware.softwareVersion, 3) As bigint) >= 5 Then 'Safe'
When tblSoftwareuni.softwareName Like '%WebEx Recorder and Player%' And
Cast(ParseName(tblSoftware.softwareVersion, 4) As bigint) > 41 Then 'Safe'
When tblSoftwareuni.softwareName Like '%WebEx Recorder and Player%' Then
'Vulnerable'
End As Status,
Case
When tblErrors.ErrorText Is Not Null Or
tblErrors.ErrorText != '' Then
'Scanning Error: ' + tsysasseterrortypes.ErrorMsg
Else ''
End As ScanningErrors,
tblAssets.Lastseen,
tblAssets.Lasttried,
Case
When tblSoftwareuni.softwareName Like '%Network Recording Player%'
And Cast(ParseName(tblSoftware.softwareVersion, 4) As bigint) = 41 And
Cast(ParseName(tblSoftware.softwareVersion, 3) As bigint) >= 4 Then
'#d4f4be'
When tblSoftwareuni.softwareName Like '%Network Recording Player%'
And Cast(ParseName(tblSoftware.softwareVersion, 4) As bigint) > 41 Then
'#d4f4be'
When tblSoftwareuni.softwareName Like '%Network Recording Player%'
Then '#ffadad'
When tblSoftwareuni.softwareName Like '%WebEx Recorder and Player%' And
Cast(ParseName(tblSoftware.softwareVersion, 4) As bigint) = 41 And
Cast(ParseName(tblSoftware.softwareVersion, 3) As bigint) >= 5 Then
'#d4f4be'
When tblSoftwareuni.softwareName Like '%WebEx Recorder and Player%' And
Cast(ParseName(tblSoftware.softwareVersion, 4) As bigint) > 41 Then
'#d4f4be'
When tblSoftwareuni.softwareName Like '%WebEx Recorder and Player%' Then
'#ffadad'
End As backgroundcolor
From tblAssets
Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
Inner Join tblSoftware On tblSoftware.AssetID = tblAssets.AssetID
Inner Join tblSoftwareuni On tblSoftwareuni.SoftID = tblSoftware.softID
Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype
Inner Join tsysIPLocations On tsysIPLocations.LocationID =
tblAssets.LocationID
Inner Join tblState On tblState.State = tblAssetCustom.State
Inner Join tblOperatingsystem On tblOperatingsystem.AssetID =
tblAssets.AssetID
Left Join tsysOS On tsysOS.OScode = tblAssets.OScode
Left Join (Select Distinct Top 1000000 tblErrors.AssetID As ID,
Max(tblErrors.Teller) As ErrorID
From tblErrors
Group By tblErrors.AssetID) As ScanningError On tblAssets.AssetID =
ScanningError.ID
Left Join tblErrors On ScanningError.ErrorID = tblErrors.Teller
Left Join tsysasseterrortypes On tsysasseterrortypes.Errortype =
tblErrors.ErrorType
Where (tblSoftwareuni.softwareName Like '%WebEx Recorder and Player%' Or
tblSoftwareuni.softwareName Like '%Network Recording Player%') And
tblState.Statename = 'Active' And tblSoftwareuni.SoftwarePublisher Like
'%Cisco WebEx%'
Order By tblAssets.Domain,
tblAssets.AssetName
