PT-2014-5281 · Cisco · Cisco Asa

Published 2014-10-08 · Updated 2023-08-15 · CVE-2014-3391

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco ASA Software versions 8.x before 8.4(3) Cisco ASA Software version 8.5 Cisco ASA Software versions 8.7 before 8.7(1.13)

Description The issue allows local users to gain privileges by placing a Trojan horse library file in external memory. This is due to an incorrect LD LIBRARY PATH value, leading to library use after device reload.

Recommendations For Cisco ASA Software versions 8.x before 8.4(3), update to version 8.4(3) or later. For Cisco ASA Software version 8.5, update to a version after 8.5. For Cisco ASA Software versions 8.7 before 8.7(1.13), update to version 8.7(1.13) or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-3391

Affected Products

Cisco Asa

References · 4

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141008-asa · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20141008-CVE-2014-3391 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3391 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3391 · Note