Vulnslist

Cisco vulnerabilities by product, model, software, and advisory.

Cisco Jabber for Windows Remote Code Execution Vulnerability

Cisco-SA-20140115-CVE-2014-0666 · Medium · Published · Updated

A vulnerability in the Send Screen Capture function of Cisco Jabber for Windows could allow an unauthenticated, remote attacker to install arbitrary files on a targeted system. The vulnerability is due to insufficient validation of data in the packets sent via the send screen capture functionality. An attacker could exploit this vulnerability by crafting or altering the packets sent as part of a send screen capture that would result in an uncontrolled directory traversal and/or acceptance of non-graphic type files. An exploit could allow the attacker to potentially execute arbitrary code on the Windows machine with the privileges of the installed Cisco Jabber for Windows client software. Cisco has confirmed the vulnerability in a security notice and released software updates. Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.

Cisco advisory · CSAF JSON

Workarounds

Administrators are advised to apply the appropriate updates.

Administrators are advised to allow only trusted users to have network access.

Administrators may consider disabling the Send Screen Capture functionality on affected systems.

Administrators are advised to monitor affected systems.

CVEsCVE-2014-0666
Cisco Bug IDsCSCug48056
CVSS ScoreBase 4.3
Base 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N/E:F/RL:OF/RC:C
Product Names From Source
Cisco Jabber for Windows

Related Products

Product CVE Evidence
Cisco Jabber for Windows CVE-2014-0666 Cisco OpenVuln
Cisco Jabber CVE-2014-0666 Cisco OpenVuln