PT-2014-3802 · Cisco · Cisco Asa

Published 2014-02-21 · Updated 2023-08-11 · CVE-2014-0738

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) Software versions 9.1(.3) and earlier

Description The issue allows remote attackers to bypass authentication and change trust relationships by injecting a Certificate Trust List (CTL) file. This could enable an unauthenticated, remote attacker to modify the trust of the Certificate Trust List (CTL) of a remote IP phone.

Recommendations For versions 9.1(.3) and earlier, consider restricting access to the Phone Proxy component until a patch is available. As a temporary workaround, consider disabling the Phone Proxy function to minimize the risk of exploitation. Avoid using the Phone Proxy component in the Cisco Adaptive Security Appliance (ASA) Software until the issue is resolved.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2014-0738

Affected Products

Cisco Asa

References · 4

• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0738 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20140221-CVE-2014-0738 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0738 · Security Note
• http://tools.cisco.com/security/center/viewAlert.x?alertId=32956 · Vendor Advisory