Vulnslist

Cisco TelePresence TC and TE Software u-boot Buffer Overflow Vulnerability

Cisco-SA-20140430-CVE-2014-2172 · Medium · Published 12 years ago · Updated 12 years ago

A vulnerability in the implementation of executable utilities that use the universal bootloader (u-boot) compiler of Cisco TelePresence TC and TE Software could allow an authenticated, local attacker to create a buffer overflow and possibly execute arbitrary code on the affected system. The vulnerability is due to the improper implementation of internal executable files when the u-boot compiler flag is defined. An attacker could exploit this vulnerability by accessing the affected system command-line interface (CLI) and try to run the affected executable files. Cisco has confirmed the vulnerability in a security advisory and released software updates. A successful exploit would require local access to the targeted device. This access requirement decreases the likelihood of a successful exploit. Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.

Cisco advisory ·CSAF JSON

Workarounds

Related Products