PT-2014-5279 · Cisco · Cisco Asa

Published 2014-10-08 · Updated 2014-10-13 · CVE-2014-3389

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco ASA Software versions 7.2 through 7.2(5.14) Cisco ASA Software versions 8.2 through 8.2(5.50) Cisco ASA Software versions 8.3 through 8.3(2.41) Cisco ASA Software versions 8.4 through 8.4(7.22) Cisco ASA Software versions 8.6 through 8.6(1.14) Cisco ASA Software versions 9.0 through 9.0(4.23) Cisco ASA Software versions 9.1 through 9.1(5.11) Cisco ASA Software versions 9.2 through 9.2(2.5) Cisco ASA Software versions 9.3 through 9.3(1.0)

Description The VPN implementation in Cisco ASA Software does not properly implement a tunnel filter, allowing remote authenticated users to obtain failover-unit access via crafted packets. There have been disruptions to some systems.

Recommendations For versions 7.2 through 7.2(5.14), update to version 7.2(5.15) or later. For versions 8.2 through 8.2(5.50), update to version 8.2(5.51) or later. For versions 8.3 through 8.3(2.41), update to version 8.3(2.42) or later. For versions 8.4 through 8.4(7.22), update to version 8.4(7.23) or later. For versions 8.6 through 8.6(1.14), update to version 8.6(1.15) or later. For versions 9.0 through 9.0(4.23), update to version 9.0(4.24) or later. For versions 9.1 through 9.1(5.11), update to version 9.1(5.12) or later. For versions 9.2 through 9.2(2.5), update to version 9.2(2.6) or later. For versions 9.3 through 9.3(1.0), update to version 9.3(1.1) or later.

Fix

Related Identifiers

CVE-2014-3389

Affected Products

Cisco Asa

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2014-3389 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141008-asa · Vendor Advisory
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141008-asa · Vendor Advisory