PT-2014-5284 · Cisco · Cisco Asa

CVE-2014-3394 · Publicado 2014-10-08 · Atualizado 2023-08-15

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco ASA Software versions 8.2 before 8.2(5.50) Cisco ASA Software versions 8.4 before 8.4(7.15) Cisco ASA Software versions 8.6 before 8.6(1.14) Cisco ASA Software versions 8.7 before 8.7(1.13) Cisco ASA Software versions 9.0 before 9.0(4.8) Cisco ASA Software versions 9.1 before 9.1(5.1)

Description The issue allows remote attackers to bypass certificate validation via an arbitrary VeriSign certificate. This could potentially lead to unauthorized access.

Recommendations For Cisco ASA Software version 8.2, update to 8.2(5.50) or later. For Cisco ASA Software version 8.4, update to 8.4(7.15) or later. For Cisco ASA Software version 8.6, update to 8.6(1.14) or later. For Cisco ASA Software version 8.7, update to 8.7(1.13) or later. For Cisco ASA Software version 9.0, update to 9.0(4.8) or later. For Cisco ASA Software version 9.1, update to 9.1(5.1) or later.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2014-3394

Produtos afetados

Cisco Asa

Referências · 5

• https://t.me/cvenotify/42734 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2014-3394 · Nota de Segurança
• https://t.me/cvenotify/30898 · Publicação no Telegram
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141008-asa · Aviso do Fabricante
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141008-asa · Aviso do Fabricante