PT-2014-1326 · Cisco · Cisco Asa

Published 2014-04-09 · Updated 2023-08-15 · CVE-2014-2128

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) Software versions 8.2 before 8.2(5.47) Cisco Adaptive Security Appliance (ASA) Software versions 8.3 before 8.3(2.40) Cisco Adaptive Security Appliance (ASA) Software versions 8.4 before 8.4(7.3) Cisco Adaptive Security Appliance (ASA) Software versions 8.6 before 8.6(1.13) Cisco Adaptive Security Appliance (ASA) Software versions 9.0 before 9.0(3.8) Cisco Adaptive Security Appliance (ASA) Software versions 9.1 before 9.1(3.2)

Description The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software has an issue that allows remote attackers to bypass authentication. This can be achieved by using specially crafted values, such as cookie values within modified HTTP POST data or specially crafted URLs.

Recommendations For version 8.2, update to 8.2(5.47) or later. For version 8.3, update to 8.3(2.40) or later. For version 8.4, update to 8.4(7.3) or later. For version 8.6, update to 8.6(1.13) or later. For version 9.0, update to 9.0(3.8) or later. For version 9.1, update to 9.1(3.2) or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2015-00182

CVE-2014-2128

Affected Products

Cisco Asa

References · 6

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-asa · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2128 · Security Note
• https://bdu.fstec.ru/vul/2015-00182 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-asa · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-2128 · Security Note
• http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCua85555 · Note