Sign-up

ID

VAR-201410-1001


CVE

CVE-2014-3382


TITLE

Cisco ASA Software SQL*Net Service disruption in inspection engines (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2014-004656

DESCRIPTION

The SQL*Net inspection engine in Cisco ASA Software 7.2 before 7.2(5.13), 8.2 before 8.2(5.50), 8.3 before 8.3(2.42), 8.4 before 8.4(7.15), 8.5 before 8.5(1.21), 8.6 before 8.6(1.14), 8.7 before 8.7(1.13), 9.0 before 9.0(4.5), and 9.1 before 9.1(5.1) allows remote attackers to cause a denial of service (device reload) via crafted SQL REDIRECT packets, aka Bug ID CSCum46027. Cisco ASA Software is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause the affected device to reload, denying service to legitimate users. This issue is being tracked by Cisco Bug ID CSCum46027. Cisco ASA is a set of firewall equipment of Cisco (Cisco). The device also includes IPS (Intrusion Prevention System), SSL VPN, IPSec VPN, antispam, and more. The vulnerability is caused by the program not properly handling SQL REDIRECT packets. The following releases are affected: Cisco ASA Software 7.2 prior to 5.13, 8.2 prior to 8.2(5.50), 8.3 prior to 8.3(2.42), 8.4 prior to 8.4(7.15), 8.5 prior to 8.5(1.21), 8.6( 1.14) before 8.6, 8.7(1.13) before 8.7, 9.0(4.5) before 9.0, 9.1(5.1) before 9.1

Trust: 1.98

sources: NVD: CVE-2014-3382 // JVNDB: JVNDB-2014-004656 // BID: 70295 // VULHUB: VHN-71322

AFFECTED PRODUCTS

vendor:ciscomodel:asascope:eqversion:8.7

Trust: 1.6

vendor:ciscomodel:asascope:eqversion:8.4.7

Trust: 1.6

vendor:ciscomodel:asascope:eqversion:8.6

Trust: 1.6

vendor:ciscomodel:asascope:eqversion:9.0

Trust: 1.6

vendor:ciscomodel:asascope:eqversion:8.5

Trust: 1.6

vendor:ciscomodel:asascope:eqversion:8.4.4

Trust: 1.6

vendor:ciscomodel:asascope:eqversion:8.4.5

Trust: 1.6

vendor:ciscomodel:asascope:eqversion:8.5.1.6

Trust: 1.6

vendor:ciscomodel:asascope:eqversion:8.4.6

Trust: 1.6

vendor:ciscomodel:asascope:eqversion:9.1

Trust: 1.6

vendor:ciscomodel:asascope:eqversion:7.2.5

Trust: 1.0

vendor:ciscomodel:asascope:eqversion:8.4.1

Trust: 1.0

vendor:ciscomodel:asascope:eqversion:8.2.5

Trust: 1.0

vendor:ciscomodel:asascope:eqversion:8.2.5.48

Trust: 1.0

vendor:ciscomodel:asascope:eqversion:8.2.5.49

Trust: 1.0

vendor:ciscomodel:asascope:eqversion:8.2.5.33

Trust: 1.0

vendor:ciscomodel:asascope:eqversion:8.2.5.41

Trust: 1.0

vendor:ciscomodel:asascope:eqversion:8.4

Trust: 1.0

vendor:ciscomodel:asascope:eqversion:8.3

Trust: 1.0

vendor:ciscomodel:asascope:eqversion:8.2.5.26

Trust: 1.0

vendor:ciscomodel:asascope:eqversion:8.4.3

Trust: 1.0

vendor:ciscomodel:asascope:eqversion:8.2.5.13

Trust: 1.0

vendor:ciscomodel:asascope:eqversion:8.2.5.46

Trust: 1.0

vendor:ciscomodel:asascope:eqversion:8.2.5.22

Trust: 1.0

vendor:ciscomodel:asascope:eqversion:7.2.5.10

Trust: 1.0

vendor:ciscomodel:asascope:eqversion:8.4.2

Trust: 1.0

vendor:ciscomodel:asascope:eqversion:8.3.2.25

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4(7.15)

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:ltversion:8.2

Trust: 0.8

vendor:ciscomodel:adaptive security appliancescope:eqversion:(asa)

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.3(2.42)

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:ltversion:9.0

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:ltversion:8.5

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:ltversion:9.1

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:ltversion:8.4

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0(4.5)

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.2(5.50)

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.7(1.13)

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1(5.1)

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:ltversion:7.2

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.6(1.14)

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:ltversion:8.6

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:ltversion:8.3

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.5(1.21)

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:7.2(5.13)

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:ltversion:8.7

Trust: 0.8

sources: JVNDB: JVNDB-2014-004656 // CNNVD: CNNVD-201410-205 // NVD: CVE-2014-3382

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-3382
value: HIGH

Trust: 1.0

NVD: CVE-2014-3382
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201410-205
value: HIGH

Trust: 0.6

VULHUB: VHN-71322
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2014-3382
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-71322
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-71322 // JVNDB: JVNDB-2014-004656 // CNNVD: CNNVD-201410-205 // NVD: CVE-2014-3382

PROBLEMTYPE DATA

problemtype:CWE-89

Trust: 1.9

sources: VULHUB: VHN-71322 // JVNDB: JVNDB-2014-004656 // NVD: CVE-2014-3382

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201410-205

TYPE

SQL injection

Trust: 0.6

sources: CNNVD: CNNVD-201410-205

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-004656

PATCH
title:cisco-sa-20141008-asaurl:http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141008-asa
Trust: 0.8
title:35905url:http://tools.cisco.com/security/center/viewAlert.x?alertId=35905
Trust: 0.8
title:cisco-sa-20141008-asaurl:http://www.cisco.com/cisco/web/support/JP/112/1126/1126286_cisco-sa-20141008-asa-j.html
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2014-004656

EXTERNAL IDS
db:NVDid:CVE-2014-3382
Trust: 2.8
db:JVNDBid:JVNDB-2014-004656
Trust: 0.8
db:CNNVDid:CNNVD-201410-205
Trust: 0.7
db:BIDid:70295
Trust: 0.4
db:VULHUBid:VHN-71322
Trust: 0.1
sources:
            
            
            VULHUB: VHN-71322 // 
            
            
            
            BID: 70295 // 
            
            
            
            JVNDB: JVNDB-2014-004656 // 
            
            
            
            CNNVD: CNNVD-201410-205 // 
            
            
            
            NVD: CVE-2014-3382

REFERENCES
url:http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20141008-asa
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-3382
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-3382
Trust: 0.8
url:http://www.cisco.com/
Trust: 0.3
sources:
            
            
            VULHUB: VHN-71322 // 
            
            
            
            BID: 70295 // 
            
            
            
            JVNDB: JVNDB-2014-004656 // 
            
            
            
            CNNVD: CNNVD-201410-205 // 
            
            
            
            NVD: CVE-2014-3382

CREDITS
Cisco
Trust: 0.3
sources:
            
            
            BID: 70295

SOURCES
db:VULHUBid:VHN-71322
db:BIDid:70295
db:JVNDBid:JVNDB-2014-004656
db:CNNVDid:CNNVD-201410-205
db:NVDid:CVE-2014-3382

LAST UPDATE DATE
2025-04-13T23:26:48.773000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-71322date:2014-10-12T00:00:00
db:BIDid:70295date:2014-10-08T00:00:00
db:JVNDBid:JVNDB-2014-004656date:2014-10-14T00:00:00
db:CNNVDid:CNNVD-201410-205date:2014-10-14T00:00:00
db:NVDid:CVE-2014-3382date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:VULHUBid:VHN-71322date:2014-10-10T00:00:00
db:BIDid:70295date:2014-10-08T00:00:00
db:JVNDBid:JVNDB-2014-004656date:2014-10-14T00:00:00
db:CNNVDid:CNNVD-201410-205date:2014-10-14T00:00:00
db:NVDid:CVE-2014-3382date:2014-10-10T10:55:06.133