CVE-2014-3407

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 28-11-2014 03:59

Last modified: - 02-06-2022 05:47

Total changes: - 2

Description

The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.3(.2) and earlier does not properly allocate memory blocks during HTTP packet handling, which allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCuq68888.

Common Vulnerability Scoring System (CVSS)

AV:N/AC:L/Au:N/C:N/I:N/A:P

Low

Attack complexity

Network

Attack vector

Low

Availability

None

Confidentiality

None

Integrity

Privileges required

Scope

User interaction

5.0

Base score

10.0

2.9

Exploitability score

Impact score

Verification logic

vendor=cisco AND product=adaptive_security_appliance_software AND versionEndIncluding=9.3\(2\)

Reference

http://tools.cisco.com/security/center/viewAlert.x?alertId=36542
20141126 Cisco ASA SSL VPN Memory Blocks Exhaustion Vulnerability-Broken Link, Vendor Advisory

Keywords

CVE-2014-3407

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2014-3407

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures