Design/Logic Flaw

The VPN implementation in Cisco ASA Software 7.2 before 7.25.15, 8.2 before 8.25.51, 8.3 before 8.32.42, 8.4 before 8.47.23, 8.6 before 8.61.15, 9.0 before 9.04.24, 9.1 before 9.15.12, 9.2 before 9.22.6, and 9.3 before 9.31.1 does not properly implement a tunnel filter, which allows remote...

Code injection

The IKE implementation in the VPN component in Cisco ASA Software 9.1 before 9.15.1 allows remote attackers to cause a denial of service device reload via crafted UDP packets, aka Bug ID CSCul36176...

Design/Logic Flaw

Untrusted search path vulnerability in Cisco ASA Software 8.x before 8.43, 8.5, and 8.7 before 8.71.13 allows local users to gain privileges by placing a Trojan horse library file in external memory, leading to library use after device reload because of an incorrect LDLIBRARYPATH value, aka Bug I...

Command injection

The SunRPC inspection engine in Cisco ASA Software 7.2 before 7.25.14, 8.2 before 8.25.51, 8.3 before 8.32.42, 8.4 before 8.47.23, 8.5 before 8.51.21, 8.6 before 8.61.14, 8.7 before 8.71.13, 9.0 before 9.04.5, and 9.1 before 9.15.3 allows remote attackers to cause a denial of service device reloa...

Code injection

The SQLNet inspection engine in Cisco ASA Software 7.2 before 7.25.13, 8.2 before 8.25.50, 8.3 before 8.32.42, 8.4 before 8.47.15, 8.5 before 8.51.21, 8.6 before 8.61.14, 8.7 before 8.71.13, 9.0 before 9.04.5, and 9.1 before 9.15.1 allows remote attackers to cause a denial of service device reloa...

Design/Logic Flaw

The Virtual Network Management Center VNMC policy implementation in Cisco ASA Software 8.7 before 8.71.14, 9.2 before 9.22.8, and 9.3 before 9.31.1 allows local users to obtain Linux root access by leveraging administrative privileges and executing a crafted script, aka Bug IDs CSCuq41510 and...

CVE-2014-3385

CVE-2014-3385 is a race condition in the Health and Performance Monitoring (HPM) feature of Cisco ASA Software that can be exploited by sending a large number of half-open TCP connections to trigger a device reload and DoS. Affected ASA versions include 8.3 (before 8.3(2.42)), 8.4 (before 8.4(7.1...

CVE-2014-3393

The Clientless SSL VPN portal customization framework in Cisco ASA Software (versions 8.2 before 8.2(5.51), 8.3 before 8.3(2.42), 8.4 before 8.4(7.23), 8.6 before 8.6(1.14), 9.0 before 9.0(4.24), 9.1 before 9.1(5.12), and 9.2 before 9.2(2.4)) fails to properly implement authentication. This flaw ...

CVE-2014-3386

The GPRS Tunneling Protocol GTP inspection engine in Cisco ASA Software 8.2 before 8.25.51, 8.4 before 8.47.15, 8.7 before 8.71.13, 9.0 before 9.04.8, and 9.1 before 9.15.1 allows remote attackers to cause a denial of service device reload via a crafted series of GTP packets, aka Bug ID CSCum5639...

CVE-2014-3391

CVE-2014-3391 is a local privilege escalation in Cisco ASA Software caused by an untrusted LD_LIBRARY_PATH that enables a Trojan-horse library to be loaded from external memory, triggering a library load after reload. Affected products are Cisco ASA Software 8.x, specifically before 8.4(3), 8.5, ...

CVE-2014-3388

The DNS inspection engine in Cisco ASA Software 9.0 before 9.04.13, 9.1 before 9.15.7, and 9.2 before 9.22 allows remote attackers to cause a denial of service device reload via crafted DNS packets, aka Bug ID CSCuo68327...

CVE-2014-3392

CVE-2014-3392 affects Cisco ASA Clientless SSL VPN Portal. A memory disclosure/memory modification flaw in the portal could be exploited remotely by crafting parameters, impacting multiple software branches. Affected versions include ASA 8.2 (up to 8.2(5.50)), 8.3 (up to 8.3(2.41)), 8.4 (up to 8....

CVE-2014-3382

The CVE-2014-3382 entry corresponds to a DoS in Cisco ASA's SQLNET Inspection Engine. A remote attacker can trigger a device reload by sending crafted SQL REDIRECT packets, affecting ASA Software releases listed in the advisory (7.2–9.1 family with specific sub-versions). The vulnerability is tie...

CVE-2014-3383

CVE-2014-3383 affects Cisco ASA Software 9.1 before 9.1(5.1). The IKE implementation in the VPN component can be triggered by crafted UDP packets, allowing a remote attacker to cause a denial of service (device reload). Affected description is supported by multiple sources in the provided connect...

CVE-2014-3387

The SunRPC inspection engine in Cisco ASA Software 7.2 before 7.25.14, 8.2 before 8.25.51, 8.3 before 8.32.42, 8.4 before 8.47.23, 8.5 before 8.51.21, 8.6 before 8.61.14, 8.7 before 8.71.13, 9.0 before 9.04.5, and 9.1 before 9.15.3 allows remote attackers to cause a denial of service device reloa...

CVE-2014-3394

The CVE-2014-3394 issue affects Cisco ASA Software’s Smart Call Home (SCH) feature, where a trustpoint (including VeriSign) installed when SCH is configured could allow remote attackers to bypass certificate validation. Affected versions include Cisco ASA Software 8.2 before 8.2(5.50), 8.4 before...

CVE-2014-3386

The CVE-2014-3386 entry concerns Cisco ASA Software, affecting the GPRS Tunneling Protocol (GTP) inspection engine. The vulnerability allows an unauthenticated, remote attacker to cause a denial of service (device reload) by sending a crafted sequence of GTP packets (Bug ID CSCum56399). Affected ...

CVE-2014-3389: Undefined Security Weakness

The VPN implementation in Cisco ASA Software 7.2 before 7.25.15, 8.2 before 8.25.51, 8.3 before 8.32.42, 8.4 before 8.47.23, 8.6 before 8.61.15, 9.0 before 9.04.24, 9.1 before 9.15.12, 9.2 before 9.22.6, and 9.3 before 9.31.1 does not properly implement a tunnel filter, which allows remote...

CVE-2014-3386: Undefined Security Weakness

The GPRS Tunneling Protocol GTP inspection engine in Cisco ASA Software 8.2 before 8.25.51, 8.4 before 8.47.15, 8.7 before 8.71.13, 9.0 before 9.04.8, and 9.1 before 9.15.1 allows remote attackers to cause a denial of service device reload via a crafted series of GTP packets, aka Bug ID CSCum5639...

CVE-2014-3392: Undefined Security Weakness

The Clientless SSL VPN portal in Cisco ASA Software 8.2 before 8.25.51, 8.3 before 8.32.42, 8.4 before 8.47.23, 8.6 before 8.61.15, 9.0 before 9.04.24, 9.1 before 9.15.12, 9.2 before 9.22.8, and 9.3 before 9.31.1 allows remote attackers to obtain sensitive information from process memory or modif...