CVE-2014-0666 (GCVE-0-2014-0666)

Vulnerability from cvelistv5 – Published: 2014-01-16 19:00 – Updated: 2024-08-06 09:20
VLAI
Summary
Directory traversal vulnerability in the Send Screen Capture implementation in Cisco Jabber 9.2(.1) and earlier on Windows allows remote attackers to upload arbitrary types of files, and consequently execute arbitrary code, via modified packets, aka Bug ID CSCug48056.
Severity
No CVSS data available.
CWE
  • n/a
Assigner
References
URL Tags
http://www.securitytracker.com/id/1029635 vdb-entryx_refsource_SECTRACK
http://tools.cisco.com/security/center/content/Ci… vendor-advisoryx_refsource_CISCO
http://tools.cisco.com/security/center/viewAlert.… x_refsource_CONFIRM
http://secunia.com/advisories/56331 third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/bid/64965 vdb-entryx_refsource_BID
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://osvdb.org/102122 vdb-entryx_refsource_OSVDB
Date Public
2014-01-15 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T09:20:19.897Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1029635",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1029635"
          },
          {
            "name": "20140115 Cisco Jabber for Windows Remote Code Execution Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0666"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=32451"
          },
          {
            "name": "56331",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/56331"
          },
          {
            "name": "64965",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/64965"
          },
          {
            "name": "cisco-jabber-cve20140666-code-exec(90435)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90435"
          },
          {
            "name": "102122",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/102122"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-01-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Directory traversal vulnerability in the Send Screen Capture implementation in Cisco Jabber 9.2(.1) and earlier on Windows allows remote attackers to upload arbitrary types of files, and consequently execute arbitrary code, via modified packets, aka Bug ID CSCug48056."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01.000Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "1029635",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1029635"
        },
        {
          "name": "20140115 Cisco Jabber for Windows Remote Code Execution Vulnerability",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0666"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=32451"
        },
        {
          "name": "56331",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/56331"
        },
        {
          "name": "64965",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/64965"
        },
        {
          "name": "cisco-jabber-cve20140666-code-exec(90435)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90435"
        },
        {
          "name": "102122",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/102122"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "ID": "CVE-2014-0666",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Directory traversal vulnerability in the Send Screen Capture implementation in Cisco Jabber 9.2(.1) and earlier on Windows allows remote attackers to upload arbitrary types of files, and consequently execute arbitrary code, via modified packets, aka Bug ID CSCug48056."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1029635",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1029635"
            },
            {
              "name": "20140115 Cisco Jabber for Windows Remote Code Execution Vulnerability",
              "refsource": "CISCO",
              "url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0666"
            },
            {
              "name": "http://tools.cisco.com/security/center/viewAlert.x?alertId=32451",
              "refsource": "CONFIRM",
              "url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=32451"
            },
            {
              "name": "56331",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/56331"
            },
            {
              "name": "64965",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/64965"
            },
            {
              "name": "cisco-jabber-cve20140666-code-exec(90435)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90435"
            },
            {
              "name": "102122",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/102122"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2014-0666",
    "datePublished": "2014-01-16T19:00:00.000Z",
    "dateReserved": "2014-01-02T00:00:00.000Z",
    "dateUpdated": "2024-08-06T09:20:19.897Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2014-0666",
      "date": "2026-07-01",
      "epss": "0.05536",
      "percentile": "0.91861"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2014-0666\",\"sourceIdentifier\":\"psirt@cisco.com\",\"published\":\"2014-01-16T19:55:04.730\",\"lastModified\":\"2026-04-29T01:13:23.040\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Directory traversal vulnerability in the Send Screen Capture implementation in Cisco Jabber 9.2(.1) and earlier on Windows allows remote attackers to upload arbitrary types of files, and consequently execute arbitrary code, via modified packets, aka Bug ID CSCug48056.\"},{\"lang\":\"es\",\"value\":\"Vulnerbailidad d erecorrido de directorios en la implementaci\u00f3n de Send Screen Capture de Cisco Jabber 9.2(.1) y anteriores en Windows permite a atacantes remotos subir tipos de archivo arbitrarios, y consecuentemente ejecutar c\u00f3digo de forma arbitraria, a trav\u00e9s de paquetes modificados, tambien conocido como Bug ID CSCug48056.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:jabber:*:-:-:*:-:windows:*:*\",\"versionEndIncluding\":\"9.2\\\\(.1\\\\)\",\"matchCriteriaId\":\"31D1EF03-FF40-421B-8930-D6FB357FE9E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:jabber:9.0:-:-:*:-:windows:*:*\",\"matchCriteriaId\":\"9C1BAB84-6EC4-44AC-BC0F-EF0A4AED83E6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:jabber:9.0\\\\(.0\\\\):-:-:*:-:windows:*:*\",\"matchCriteriaId\":\"CD53E475-7F41-4722-9DC8-2CA4E06BA3D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:jabber:9.0\\\\(.1\\\\):-:-:*:-:windows:*:*\",\"matchCriteriaId\":\"1AEEB642-4B2A-46A0-A007-00F5271FB007\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:jabber:9.0\\\\(.2\\\\):-:-:*:-:windows:*:*\",\"matchCriteriaId\":\"45EC995E-27E6-490A-B6FF-27E6A614D6A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:jabber:9.0\\\\(.3\\\\):-:-:*:-:windows:*:*\",\"matchCriteriaId\":\"1C8E025B-B512-4812-B893-6A91BA500B5B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:jabber:9.0\\\\(.4\\\\):-:-:*:-:windows:*:*\",\"matchCriteriaId\":\"39B05E17-DF9C-4FEE-963E-3F8EDC16A0DE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:jabber:9.0\\\\(.5\\\\):-:-:*:-:windows:*:*\",\"matchCriteriaId\":\"EDDC24DC-08C4-40E7-BCD1-C8031AE46CEF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:jabber:9.1:-:-:*:-:windows:*:*\",\"matchCriteriaId\":\"D976A52F-30A5-4390-9DEF-C196EFD72A9B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:jabber:9.1\\\\(.0\\\\):-:-:*:-:windows:*:*\",\"matchCriteriaId\":\"CF652900-65FF-4599-929A-3E3F9E07138D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:jabber:9.1\\\\(.1\\\\):-:-:*:-:windows:*:*\",\"matchCriteriaId\":\"891CDFBD-8C70-4711-B90B-8734E39FA937\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:jabber:9.1\\\\(.2\\\\):-:-:*:-:windows:*:*\",\"matchCriteriaId\":\"19615E29-B957-4904-9937-472752842FD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:jabber:9.1\\\\(.3\\\\):-:-:*:-:windows:*:*\",\"matchCriteriaId\":\"41466543-F95C-48EC-BD65-65C1D20315CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:jabber:9.1\\\\(.4\\\\):-:-:*:-:windows:*:*\",\"matchCriteriaId\":\"1448DA4E-A06F-464E-8CDA-E2ADF3BB6429\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:jabber:9.1\\\\(.5\\\\):-:-:*:-:windows:*:*\",\"matchCriteriaId\":\"EC3FEAED-786F-41D7-A9F0-61ED0E9EAFBD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:jabber:9.2:-:-:*:-:windows:*:*\",\"matchCriteriaId\":\"89F425F6-62A3-496E-ACF6-9C2504B7F5EA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:jabber:9.2\\\\(.0\\\\):-:-:*:-:windows:*:*\",\"matchCriteriaId\":\"BD36095C-939A-4161-A0DA-DA514AA58A05\"}]}]}],\"references\":[{\"url\":\"http://osvdb.org/102122\",\"source\":\"psirt@cisco.com\"},{\"url\":\"http://secunia.com/advisories/56331\",\"source\":\"psirt@cisco.com\"},{\"url\":\"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0666\",\"source\":\"psirt@cisco.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://tools.cisco.com/security/center/viewAlert.x?alertId=32451\",\"source\":\"psirt@cisco.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/64965\",\"source\":\"psirt@cisco.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id/1029635\",\"source\":\"psirt@cisco.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/90435\",\"source\":\"psirt@cisco.com\"},{\"url\":\"http://osvdb.org/102122\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/56331\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0666\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://tools.cisco.com/security/center/viewAlert.x?alertId=32451\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/64965\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id/1029635\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/90435\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.