CVE-2014-0661: Code Injection
Published Jan 22, 2014
·Updated
The System Status Collection Daemon (SSCD) in Cisco TelePresence System 500-37, 1000, 1300-65, and 3xxx before 1.10.2(42), and 500-32, 1300-47, TX1310 65, and TX9xxx before 6.0.4(11), allows remote attackers to execute arbitrary commands or cause a denial of service (stack memory corruption) via a crafted XML-RPC message, aka Bug ID CSCui32796.
Affected Software
78 affected components
Cisco TelePresence System Software<=1.10.1\(43\)
Cisco TelePresence System Software=1.5.10\(3648\)
Cisco TelePresence System Software=1.7.5\(42\)
Cisco TelePresence System Software=1.7.6\(4\)
Cisco TelePresence System Software=1.8.0\(55\)
Cisco TelePresence System Software=1.8.1\(34\)
Cisco TelePresence System Software=1.8.2\(11\)
Cisco TelePresence System Software=1.8.3\(4\)
Cisco TelePresence System Software=1.8.4\(13\)
Cisco TelePresence System Software=1.8.5\(4\)
Cisco TelePresence System Software=1.9.0\(46\)
Cisco TelePresence System Software=1.9.1\(68\)
Cisco TelePresence System Software=1.9.2\(19\)
Cisco TelePresence System Software=1.9.3\(44\)
Cisco TelePresence System Software=1.9.4\(19\)
Cisco TelePresence System Software=1.9.5\(7\)
Cisco TelePresence System Software=1.9.6\(2\)
Cisco TelePresence System Software=1.9.6.1\(3\)
Cisco TelePresence System Software=1.10.0
Cisco TelePresence System Software=1.10.0\(259\)
Cisco TelePresence System Software=1.10.1
Cisco Telepresence System 1000
Cisco Telepresence System 1300-65
Cisco Telepresence System 3000
Cisco Telepresence System 3010
Cisco Telepresence System 3200
Cisco Telepresence System 3210
Cisco TelePresence System 500-37
Cisco TelePresence System Software<=6.0.3\(33\)
Cisco TelePresence System Software=6.0.0.1\(4\)
Cisco TelePresence System Software=6.0.1\(50\)
Cisco TelePresence System Software=6.0.2\(28\)
Cisco TelePresence System Software=6.1.0\(90\)
Cisco Telepresence System 1100
Cisco Telepresence System 500-32
Cisco Telepresence System Tx1300 47
Cisco Telepresence System Tx1310 65
Cisco Telepresence System Tx9000
Cisco Telepresence System Tx9200
All of the following
Any of the following
Cisco TelePresence System Software<=1.10.1\(43\)
Cisco TelePresence System Software=1.5.10\(3648\)
Cisco TelePresence System Software=1.7.5\(42\)
Cisco TelePresence System Software=1.7.6\(4\)
Cisco TelePresence System Software=1.8.0\(55\)
Cisco TelePresence System Software=1.8.1\(34\)
Cisco TelePresence System Software=1.8.2\(11\)
Cisco TelePresence System Software=1.8.3\(4\)
Cisco TelePresence System Software=1.8.4\(13\)
Cisco TelePresence System Software=1.8.5\(4\)
Cisco TelePresence System Software=1.9.0\(46\)
Cisco TelePresence System Software=1.9.1\(68\)
Cisco TelePresence System Software=1.9.2\(19\)
Cisco TelePresence System Software=1.9.3\(44\)
Cisco TelePresence System Software=1.9.4\(19\)
Cisco TelePresence System Software=1.9.5\(7\)
Cisco TelePresence System Software=1.9.6\(2\)
Cisco TelePresence System Software=1.9.6.1\(3\)
Cisco TelePresence System Software=1.10.0
Cisco TelePresence System Software=1.10.0\(259\)
Cisco TelePresence System Software=1.10.1
Any of the following
Cisco Telepresence System 1000
Cisco Telepresence System 1300-65
Cisco Telepresence System 3000
Cisco Telepresence System 3010
Cisco Telepresence System 3200
Cisco Telepresence System 3210
Cisco TelePresence System 500-37
All of the following
Any of the following
Cisco TelePresence System Software<=6.0.3\(33\)
Cisco TelePresence System Software=6.0.0.1\(4\)
Cisco TelePresence System Software=6.0.1\(50\)
Cisco TelePresence System Software=6.0.2\(28\)
Cisco TelePresence System Software=6.1.0\(90\)
Any of the following
Cisco Telepresence System 1100
Cisco Telepresence System 500-32
Cisco Telepresence System Tx1300 47
Cisco Telepresence System Tx1310 65
Cisco Telepresence System Tx9000
Cisco Telepresence System Tx9200
Event History
Jan 22, 2014
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Data Sourced
via NVD·09:55 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-0661?
CVE-2014-0661 is rated as high severity due to its potential for remote code execution and denial of service.
2
How do I fix CVE-2014-0661?
To fix CVE-2014-0661, upgrade the affected Cisco TelePresence System Software to version 1.10.2(42) or higher.
3
Which devices are affected by CVE-2014-0661?
CVE-2014-0661 affects Cisco TelePresence System models including the 500-37, 1000, 1300-65, and various TX models.
4
What types of attacks can CVE-2014-0661 enable?
CVE-2014-0661 can allow remote attackers to execute arbitrary commands or cause a denial of service.
5
Is there a workaround for CVE-2014-0661?
Currently, there is no specific workaround for CVE-2014-0661; the primary recommendation is to update to a fixed version.