PT-2014-3802 · Cisco · Cisco Asa

CVE-2014-0738 · Publicado 2014-02-21 · Atualizado 2023-08-11

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) Software versions 9.1(.3) and earlier

Description The issue allows remote attackers to bypass authentication and change trust relationships by injecting a Certificate Trust List (CTL) file. This could enable an unauthenticated, remote attacker to modify the trust of the Certificate Trust List (CTL) of a remote IP phone.

Recommendations For versions 9.1(.3) and earlier, consider restricting access to the Phone Proxy component until a patch is available. As a temporary workaround, consider disabling the Phone Proxy function to minimize the risk of exploitation. Avoid using the Phone Proxy component in the Cisco Adaptive Security Appliance (ASA) Software until the issue is resolved.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2014-0738

Produtos afetados

Cisco Asa

Referências · 4

• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0738 · Aviso do Fabricante
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20140221-CVE-2014-0738 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-0738 · Nota de Segurança
• http://tools.cisco.com/security/center/viewAlert.x?alertId=32956 · Aviso do Fabricante