Cisco-SA-20140710-CVE-2014-3311

A vulnerability in the file sharing functionality of the Cisco WebEx Meetings client could allow an unauthenticated, remote attacker to trigger a heap-based buffer overflow in the Cisco WebEx Meetings client running on another user's computer. The vulnerability exists because the affected software does not properly check the bounds of the data being transferred. An attacker could exploit this vulnerability by using a modified Cisco WebEx Meetings client. An exploit could allow the attacker to execute code on the remote computer or cause a denial of service (DoS) condition by crashing the remote Cisco WebEx Meetings client. Cisco has confirmed the vulnerability in a security notice and released software updates. To exploit this vulnerability, an attacker may attempt to convince a targeted user to download a malformed file with the Cisco WebEx Meetings client by using misleading language and instructions. Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.