CVE-2014-3385

CVE-2014-3385 is a race condition in the Health and Performance Monitoring (HPM) feature of Cisco ASA Software that can be exploited by sending a large number of half-open TCP connections to trigger a device reload and DoS. Affected ASA versions include 8.3 (before 8.3(2.42)), 8.4 (before 8.4(7.1...

CVE-2014-3383

CVE-2014-3383 affects Cisco ASA Software 9.1 before 9.1(5.1). The IKE implementation in the VPN component can be triggered by crafted UDP packets, allowing a remote attacker to cause a denial of service (device reload). Affected description is supported by multiple sources in the provided connect...

CVE-2014-3393: Improper Authentication

The Clientless SSL VPN portal customization framework in Cisco ASA Software 8.2 before 8.25.51, 8.3 before 8.32.42, 8.4 before 8.47.23, 8.6 before 8.61.14, 9.0 before 9.04.24, 9.1 before 9.15.12, and 9.2 before 9.22.4 does not properly implement authentication, which allows remote attackers to...

CVE-2014-3385: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in the Health and Performance Monitoring HPM for ASDM feature in Cisco ASA Software 8.3 before 8.32.42, 8.4 before 8.47.11, 8.5 before 8.51.19, 8.6 before 8.61.13, 8.7 before 8.71.11, 9.0 before 9.04.8, and 9.1 before 9.14.5 allows remote attackers to cause a denial of service devi...

CVE-2014-3392: Undefined Security Weakness

The Clientless SSL VPN portal in Cisco ASA Software 8.2 before 8.25.51, 8.3 before 8.32.42, 8.4 before 8.47.23, 8.6 before 8.61.15, 9.0 before 9.04.24, 9.1 before 9.15.12, 9.2 before 9.22.8, and 9.3 before 9.31.1 allows remote attackers to obtain sensitive information from process memory or modif...

CVE-2014-3384: Undefined Security Weakness

The IKEv2 implementation in Cisco ASA Software 8.4 before 8.47.15, 8.6 before 8.61.14, 9.0 before 9.04.8, and 9.1 before 9.15.1 allows remote attackers to cause a denial of service device reload via a crafted packet that is sent during tunnel creation, aka Bug ID CSCum96401...

CVE-2014-3390: Improper Input Validation

The Virtual Network Management Center VNMC policy implementation in Cisco ASA Software 8.7 before 8.71.14, 9.2 before 9.22.8, and 9.3 before 9.31.1 allows local users to obtain Linux root access by leveraging administrative privileges and executing a crafted script, aka Bug IDs CSCuq41510 and...

CVE-2014-3394: Improper Certificate Validation

The Smart Call Home SCH implementation in Cisco ASA Software 8.2 before 8.25.50, 8.4 before 8.47.15, 8.6 before 8.61.14, 8.7 before 8.71.13, 9.0 before 9.04.8, and 9.1 before 9.15.1 allows remote attackers to bypass certificate validation via an arbitrary VeriSign certificate, aka Bug ID CSCun109...

CVE-2014-3389: Undefined Security Weakness

The VPN implementation in Cisco ASA Software 7.2 before 7.25.15, 8.2 before 8.25.51, 8.3 before 8.32.42, 8.4 before 8.47.23, 8.6 before 8.61.15, 9.0 before 9.04.24, 9.1 before 9.15.12, 9.2 before 9.22.6, and 9.3 before 9.31.1 does not properly implement a tunnel filter, which allows remote...

CVE-2014-3387: Undefined Security Weakness

The SunRPC inspection engine in Cisco ASA Software 7.2 before 7.25.14, 8.2 before 8.25.51, 8.3 before 8.32.42, 8.4 before 8.47.23, 8.5 before 8.51.21, 8.6 before 8.61.14, 8.7 before 8.71.13, 9.0 before 9.04.5, and 9.1 before 9.15.3 allows remote attackers to cause a denial of service device reloa...

CVE-2014-3386: Undefined Security Weakness

The GPRS Tunneling Protocol GTP inspection engine in Cisco ASA Software 8.2 before 8.25.51, 8.4 before 8.47.15, 8.7 before 8.71.13, 9.0 before 9.04.8, and 9.1 before 9.15.1 allows remote attackers to cause a denial of service device reload via a crafted series of GTP packets, aka Bug ID CSCum5639...

CVE-2014-3391: Improper Input Validation

Untrusted search path vulnerability in Cisco ASA Software 8.x before 8.43, 8.5, and 8.7 before 8.71.13 allows local users to gain privileges by placing a Trojan horse library file in external memory, leading to library use after device reload because of an incorrect LDLIBRARYPATH value, aka Bug I...

CVE-2014-3383: Undefined Security Weakness

The IKE implementation in the VPN component in Cisco ASA Software 9.1 before 9.15.1 allows remote attackers to cause a denial of service device reload via crafted UDP packets, aka Bug ID CSCul36176...

CVE-2014-3388: Undefined Security Weakness

The DNS inspection engine in Cisco ASA Software 9.0 before 9.04.13, 9.1 before 9.15.7, and 9.2 before 9.22 allows remote attackers to cause a denial of service device reload via crafted DNS packets, aka Bug ID CSCuo68327...

PT-2014-5280 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco ASA Software versions 8.7 before 8.71.14 Cisco ASA Software versions 9.2 before 9.22.8 Cisco ASA Software versions 9.3 before 9.31.1 Description: The issue allows local users to obtain Linux root access by leveraging administrative...

Cisco Releases Security Advisory for ASA Software

Cisco has released an advisory to address multiple vulnerabilities in the Cisco Adaptive Security Appliance ASA Software that could result in a denial of service condition. Cisco has released free software updates that address these vulnerabilities. Users and administrators are encouraged to revi...

PT-2014-5276

Name of the Vulnerable Software and Affected Versions Cisco ASA Software versions 8.2 through 8.25.50 Cisco ASA Software versions 8.4 through 8.47.14 Cisco ASA Software versions 8.7 through 8.71.12 Cisco ASA Software versions 9.0 through 9.04.7 Cisco ASA Software versions 9.1 through 9.15.0...

PT-2014-5278

Name of the Vulnerable Software and Affected Versions Cisco ASA Software versions 9.0 through 9.04.12 Cisco ASA Software versions 9.1 through 9.15.6 Cisco ASA Software versions 9.2 through 9.21 Description The issue allows remote attackers to cause a denial of service, resulting in a device reloa...

CVE-2014-3399

The SSL VPN implementation in Cisco Adaptive Security Appliance ASA Software 9.2.2.4 and earlier does not properly manage session information during creation of a SharePoint handler, which allows remote authenticated users to overwrite arbitrary RAMFS cache files or inject Lua programs, and...

CVE-2014-3399

Cisco ASA Software SSL VPN contains CVE-2014-3399: improper validation of session information during SharePoint handler creation allows an authenticated, remote attacker to overwrite RAMFS cache files or inject Lua scripts, causing a DoS (portal outage or system reload). Affected releases include...