Details of VAR-201410-0076

ID

VAR-201410-0076

CVE

CVE-2014-3389

TITLE

Cisco ASA Software VPN Vulnerability to gain access to failover units

Trust: 0.8

sources: JVNDB: JVNDB-2014-004663

DESCRIPTION

The VPN implementation in Cisco ASA Software 7.2 before 7.2(5.15), 8.2 before 8.2(5.51), 8.3 before 8.3(2.42), 8.4 before 8.4(7.23), 8.6 before 8.6(1.15), 9.0 before 9.0(4.24), 9.1 before 9.1(5.12), 9.2 before 9.2(2.6), and 9.3 before 9.3(1.1) does not properly implement a tunnel filter, which allows remote authenticated users to obtain failover-unit access via crafted packets, aka Bug ID CSCuq28582. Vendors have confirmed this vulnerability Bug ID CSCuq28582 It is released as.A unit of failover via a crafted packet by a remotely authenticated user (failover-unit) You may get access to. Successfully exploiting this issue may allow an attacker to execute configuration commands to the standby unit through the failover interface. This issue is being tracked by Cisco bug ID CSCuq28582. Cisco ASA is a set of firewall equipment of Cisco (Cisco). The device also includes IPS (Intrusion Prevention System), SSL VPN, IPSec VPN, antispam, and more. A remote attacker could exploit this vulnerability with a specially crafted packet to gain access to the failover-unit. The following versions are affected: Cisco ASA Software 7.2 prior to 5.15, 8.2 prior to 8.2(5.51), 8.3 prior to 8.3(2.42), 8.4 prior to 8.4(7.23), 8.6 prior to 8.6(1.15), 9.0( Version 9.0 before 4.24), Version 9.1 before 9.1(5.12), Version 9.2 before 9.2(2.6), Version 9.3 before 9.3(1.1)

Trust: 1.98

sources: NVD: CVE-2014-3389 // JVNDB: JVNDB-2014-004663 // BID: 70297 // VULHUB: VHN-71329

AFFECTED PRODUCTS

vendor:	cisco	model:	asa	scope:	eq	version:	8.2.5.26	Trust: 1.6
vendor:	cisco	model:	asa	scope:	eq	version:	8.2.5.48	Trust: 1.6
vendor:	cisco	model:	asa	scope:	eq	version:	8.2.5.49	Trust: 1.6
vendor:	cisco	model:	asa	scope:	eq	version:	8.2.5.46	Trust: 1.6
vendor:	cisco	model:	asa	scope:	eq	version:	8.2.5.13	Trust: 1.6
vendor:	cisco	model:	asa	scope:	eq	version:	8.2.5.22	Trust: 1.6
vendor:	cisco	model:	asa	scope:	eq	version:	8.2.5.41	Trust: 1.6
vendor:	cisco	model:	asa	scope:	eq	version:	7.2.5	Trust: 1.6
vendor:	cisco	model:	asa	scope:	eq	version:	8.2.5.33	Trust: 1.6
vendor:	cisco	model:	asa	scope:	eq	version:	7.2.5.10	Trust: 1.6
vendor:	cisco	model:	asa	scope:	eq	version:	8.4.1	Trust: 1.0
vendor:	cisco	model:	asa	scope:	eq	version:	9.0	Trust: 1.0
vendor:	cisco	model:	asa	scope:	eq	version:	8.2.5	Trust: 1.0
vendor:	cisco	model:	asa	scope:	eq	version:	8.4.4	Trust: 1.0
vendor:	cisco	model:	asa	scope:	eq	version:	8.4	Trust: 1.0
vendor:	cisco	model:	asa	scope:	eq	version:	8.3	Trust: 1.0
vendor:	cisco	model:	asa	scope:	eq	version:	8.6	Trust: 1.0
vendor:	cisco	model:	asa	scope:	eq	version:	8.4.7	Trust: 1.0
vendor:	cisco	model:	asa	scope:	eq	version:	8.4.3	Trust: 1.0
vendor:	cisco	model:	asa	scope:	eq	version:	9.1	Trust: 1.0
vendor:	cisco	model:	asa	scope:	eq	version:	8.4.6	Trust: 1.0
vendor:	cisco	model:	asa	scope:	eq	version:	8.4.5	Trust: 1.0
vendor:	cisco	model:	asa	scope:	eq	version:	9.3	Trust: 1.0
vendor:	cisco	model:	asa	scope:	eq	version:	8.4.2	Trust: 1.0
vendor:	cisco	model:	asa	scope:	eq	version:	9.2	Trust: 1.0
vendor:	cisco	model:	asa	scope:	eq	version:	8.3.2.25	Trust: 1.0
vendor:	cisco	model:	adaptive security appliance software	scope:	lt	version:	8.2	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	9.1(5.12)	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance	scope:	eq	version:	(asa)	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	8.3(2.42)	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	lt	version:	9.0	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	9.2(2.6)	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	9.0(4.24)	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	lt	version:	9.1	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	lt	version:	8.4	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	9.3(1.1)	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	7.2(5.15)	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	lt	version:	9.2	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	lt	version:	7.2	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	8.6(1.15)	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	lt	version:	8.6	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	8.4(7.23)	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	lt	version:	8.3	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	8.2(5.51)	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	lt	version:	9.3	Trust: 0.8

sources: JVNDB: JVNDB-2014-004663 // CNNVD: CNNVD-201410-212 // NVD: CVE-2014-3389

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2014-3389
value:	HIGH
Trust: 1.0
NVD:	CVE-2014-3389
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201410-212
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-71329
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2014-3389
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-71329
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-71329 // JVNDB: JVNDB-2014-004663 // CNNVD: CNNVD-201410-212 // NVD: CVE-2014-3389

PROBLEMTYPE DATA

problemtype:	NVD-CWE-Other	Trust: 1.0
problemtype:	CWE-Other	Trust: 0.8

sources: JVNDB: JVNDB-2014-004663 // NVD: CVE-2014-3389

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201410-212

TYPE

Input Validation Error

Trust: 0.3

sources: BID: 70297

CONFIGURATIONS

sources: JVNDB: JVNDB-2014-004663

PATCH

title:	cisco-sa-20141008-asa	url:	http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141008-asa	Trust: 0.8
title:	35912	url:	http://tools.cisco.com/security/center/viewAlert.x?alertId=35912	Trust: 0.8
title:	cisco-sa-20141008-asa	url:	http://www.cisco.com/cisco/web/support/JP/112/1126/1126286_cisco-sa-20141008-asa-j.html	Trust: 0.8

sources: JVNDB: JVNDB-2014-004663

EXTERNAL IDS

db:	NVD	id:	CVE-2014-3389	Trust: 2.8
db:	JVNDB	id:	JVNDB-2014-004663	Trust: 0.8
db:	CNNVD	id:	CNNVD-201410-212	Trust: 0.7
db:	BID	id:	70297	Trust: 0.4
db:	VULHUB	id:	VHN-71329	Trust: 0.1

sources: VULHUB: VHN-71329 // BID: 70297 // JVNDB: JVNDB-2014-004663 // CNNVD: CNNVD-201410-212 // NVD: CVE-2014-3389

REFERENCES

url:	http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20141008-asa	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-3389	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-3389	Trust: 0.8
url:	http://www.cisco.com/en/us/products/ps6120/index.html	Trust: 0.3
url:	http://www.cisco.com/	Trust: 0.3

sources: VULHUB: VHN-71329 // BID: 70297 // JVNDB: JVNDB-2014-004663 // CNNVD: CNNVD-201410-212 // NVD: CVE-2014-3389

CREDITS

Alec Stuart-Muirk

Trust: 0.3

sources: BID: 70297

SOURCES

db:	VULHUB	id:	VHN-71329
db:	BID	id:	70297
db:	JVNDB	id:	JVNDB-2014-004663
db:	CNNVD	id:	CNNVD-201410-212
db:	NVD	id:	CVE-2014-3389

LAST UPDATE DATE

2025-04-13T23:32:47.883000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-71329	date:	2014-10-13T00:00:00
db:	BID	id:	70297	date:	2014-10-08T00:00:00
db:	JVNDB	id:	JVNDB-2014-004663	date:	2014-10-14T00:00:00
db:	CNNVD	id:	CNNVD-201410-212	date:	2014-10-16T00:00:00
db:	NVD	id:	CVE-2014-3389	date:	2025-04-12T10:46:40.837

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-71329	date:	2014-10-10T00:00:00
db:	BID	id:	70297	date:	2014-10-08T00:00:00
db:	JVNDB	id:	JVNDB-2014-004663	date:	2014-10-14T00:00:00
db:	CNNVD	id:	CNNVD-201410-212	date:	2014-10-14T00:00:00
db:	NVD	id:	CVE-2014-3389	date:	2014-10-10T10:55:06.477