PT-2014-5280 · Cisco · Cisco Asa

Published 2014-10-08 · Updated 2023-08-15 · CVE-2014-3390

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco ASA Software versions 8.7 before 8.7(1.14) Cisco ASA Software versions 9.2 before 9.2(2.8) Cisco ASA Software versions 9.3 before 9.3(1.1)

Description The issue allows local users to obtain Linux root access by leveraging administrative privileges and executing a crafted script. There have been disruptions to some systems.

Recommendations For Cisco ASA Software version 8.7, update to 8.7(1.14) or later. For Cisco ASA Software version 9.2, update to 9.2(2.8) or later. For Cisco ASA Software version 9.3, update to 9.3(1.1) or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-3390

Affected Products

Cisco Asa

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-3390 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141008-asa · Vendor Advisory
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141008-asa · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3390 · Note