Details of VAR-201410-0073

ID

VAR-201410-0073

CVE

CVE-2014-3386

TITLE

Cisco ASA Software GPRS Tunneling Protocol Service disruption in inspection engines (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2014-004660

DESCRIPTION

The GPRS Tunneling Protocol (GTP) inspection engine in Cisco ASA Software 8.2 before 8.2(5.51), 8.4 before 8.4(7.15), 8.7 before 8.7(1.13), 9.0 before 9.0(4.8), and 9.1 before 9.1(5.1) allows remote attackers to cause a denial of service (device reload) via a crafted series of GTP packets, aka Bug ID CSCum56399. Cisco Adaptive Security Appliance (ASA) Software is prone to a denial-of-service vulnerability. An attacker can exploit this issue to cause the affected device to reload, denying service to legitimate users. This issue is tracked by Cisco Bug ID CSCum56399. Cisco ASA is a set of firewall equipment of Cisco (Cisco). The device also includes IPS (Intrusion Prevention System), SSL VPN, IPSec VPN, antispam, and more. The vulnerability stems from the program's improper handling of GTP packet sequences. The following releases are affected: Cisco ASA Software 8.2 prior to 5.51, 8.4 prior to 8.4(7.15), 8.7 prior to 8.7(1.13), 9.0 prior to 9.0(4.8), 9.1 prior to 9.1(5.1)

Trust: 1.98

sources: NVD: CVE-2014-3386 // JVNDB: JVNDB-2014-004660 // BID: 70301 // VULHUB: VHN-71326

AFFECTED PRODUCTS

vendor:	cisco	model:	asa	scope:	eq	version:	8.4	Trust: 1.6
vendor:	cisco	model:	asa	scope:	eq	version:	8.4.7	Trust: 1.6
vendor:	cisco	model:	asa	scope:	eq	version:	8.7	Trust: 1.6
vendor:	cisco	model:	asa	scope:	eq	version:	8.4.2	Trust: 1.6
vendor:	cisco	model:	asa	scope:	eq	version:	8.4.3	Trust: 1.6
vendor:	cisco	model:	asa	scope:	eq	version:	9.0	Trust: 1.6
vendor:	cisco	model:	asa	scope:	eq	version:	8.4.4	Trust: 1.6
vendor:	cisco	model:	asa	scope:	eq	version:	8.4.5	Trust: 1.6
vendor:	cisco	model:	asa	scope:	eq	version:	8.4.6	Trust: 1.6
vendor:	cisco	model:	asa	scope:	eq	version:	9.1	Trust: 1.6
vendor:	cisco	model:	asa	scope:	eq	version:	8.4.1	Trust: 1.0
vendor:	cisco	model:	asa	scope:	eq	version:	8.2.5	Trust: 1.0
vendor:	cisco	model:	asa	scope:	eq	version:	8.2.5.48	Trust: 1.0
vendor:	cisco	model:	asa	scope:	eq	version:	8.2.5.49	Trust: 1.0
vendor:	cisco	model:	asa	scope:	eq	version:	8.2.5.33	Trust: 1.0
vendor:	cisco	model:	asa	scope:	eq	version:	8.2.5.41	Trust: 1.0
vendor:	cisco	model:	asa	scope:	eq	version:	8.2.5.26	Trust: 1.0
vendor:	cisco	model:	asa	scope:	eq	version:	8.2.5.13	Trust: 1.0
vendor:	cisco	model:	asa	scope:	eq	version:	8.2.5.46	Trust: 1.0
vendor:	cisco	model:	asa	scope:	eq	version:	8.2.5.22	Trust: 1.0
vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	8.7(1.13)	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	9.1(5.1)	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	8.4(7.15)	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	8.2(5.51)	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	lt	version:	8.2	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	9.0(4.8)	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	lt	version:	9.1	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	lt	version:	8.4	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance	scope:	eq	version:	(asa)	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	lt	version:	9.0	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	lt	version:	8.7	Trust: 0.8

sources: JVNDB: JVNDB-2014-004660 // CNNVD: CNNVD-201410-209 // NVD: CVE-2014-3386

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2014-3386
value:	HIGH
Trust: 1.0
NVD:	CVE-2014-3386
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201410-209
value:	HIGH
Trust: 0.6
VULHUB:	VHN-71326
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2014-3386
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-71326
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-71326 // JVNDB: JVNDB-2014-004660 // CNNVD: CNNVD-201410-209 // NVD: CVE-2014-3386

PROBLEMTYPE DATA

problemtype:

CWE-399

Trust: 1.9

sources: VULHUB: VHN-71326 // JVNDB: JVNDB-2014-004660 // NVD: CVE-2014-3386

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201410-209

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-201410-209

CONFIGURATIONS

sources: JVNDB: JVNDB-2014-004660

PATCH

title:	cisco-sa-20141008-asa	url:	http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141008-asa	Trust: 0.8
title:	35909	url:	http://tools.cisco.com/security/center/viewAlert.x?alertId=35909	Trust: 0.8
title:	cisco-sa-20141008-asa	url:	http://www.cisco.com/cisco/web/support/JP/112/1126/1126286_cisco-sa-20141008-asa-j.html	Trust: 0.8

sources: JVNDB: JVNDB-2014-004660

EXTERNAL IDS

db:	NVD	id:	CVE-2014-3386	Trust: 2.8
db:	JVNDB	id:	JVNDB-2014-004660	Trust: 0.8
db:	CNNVD	id:	CNNVD-201410-209	Trust: 0.6
db:	BID	id:	70301	Trust: 0.4
db:	VULHUB	id:	VHN-71326	Trust: 0.1

sources: VULHUB: VHN-71326 // BID: 70301 // JVNDB: JVNDB-2014-004660 // CNNVD: CNNVD-201410-209 // NVD: CVE-2014-3386

REFERENCES

url:	http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20141008-asa	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-3386	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-3386	Trust: 0.8
url:	www.cisco.com	Trust: 0.3

sources: VULHUB: VHN-71326 // BID: 70301 // JVNDB: JVNDB-2014-004660 // CNNVD: CNNVD-201410-209 // NVD: CVE-2014-3386

CREDITS

Cisco

Trust: 0.3

sources: BID: 70301

SOURCES

db:	VULHUB	id:	VHN-71326
db:	BID	id:	70301
db:	JVNDB	id:	JVNDB-2014-004660
db:	CNNVD	id:	CNNVD-201410-209
db:	NVD	id:	CVE-2014-3386

LAST UPDATE DATE

2025-04-13T23:36:34.552000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-71326	date:	2014-10-13T00:00:00
db:	BID	id:	70301	date:	2014-10-08T00:00:00
db:	JVNDB	id:	JVNDB-2014-004660	date:	2014-10-14T00:00:00
db:	CNNVD	id:	CNNVD-201410-209	date:	2014-10-14T00:00:00
db:	NVD	id:	CVE-2014-3386	date:	2025-04-12T10:46:40.837

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-71326	date:	2014-10-10T00:00:00
db:	BID	id:	70301	date:	2014-10-08T00:00:00
db:	JVNDB	id:	JVNDB-2014-004660	date:	2014-10-14T00:00:00
db:	CNNVD	id:	CNNVD-201410-209	date:	2014-10-14T00:00:00
db:	NVD	id:	CVE-2014-3386	date:	2014-10-10T10:55:06.337