CVE-2014-3390
published 2014-10-10CVE-2014-3390: The Virtual Network Management Center (VNMC) policy implementation in Cisco ASA Software 8.7 before 8.7(1.14), 9.2 before 9.2(2.8), and 9.3 before 9.3(1.1)…
PriorityP423medium6.8CVSS 2.0
AVLACLAuSCCICAC
EPSS
0.35%
27.2th percentile
The Virtual Network Management Center (VNMC) policy implementation in Cisco ASA Software 8.7 before 8.7(1.14), 9.2 before 9.2(2.8), and 9.3 before 9.3(1.1) allows local users to obtain Linux root access by leveraging administrative privileges and executing a crafted script, aka Bug IDs CSCuq41510 and CSCuq47574.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | adaptive_security_appliance_software | — | — |
| cisco | adaptive_security_appliance_software | — | — |
| cisco | adaptive_security_appliance_software | — | — |
| cisco | adaptive_security_appliance_software | — | — |
| cisco | adaptive_security_appliance_software | — | — |
| cisco | adaptive_security_appliance_software | — | — |
| cisco | adaptive_security_appliance_software | — | — |
| cisco | adaptive_security_appliance_software | — | — |
| cisco | adaptive_security_appliance_software | — | — |
| cisco | adaptive_security_appliance_software | — | — |
| cisco | adaptive_security_appliance_software | — | — |
| cisco | adaptive_security_appliance_software | — | — |
| cisco | asa | — | — |
CVSS provenance
nvdv2.06.8MEDIUMAV:L/AC:L/Au:S/C:C/I:C/A:C
vendor_cisco7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco ASA Authenticated Linux Shell Access Vulnerability
vendor_cisco·2014-10-08·CVSS 6.8
CVE-2014-3390 [MEDIUM] CWE-20 Cisco ASA Authenticated Linux Shell Access Vulnerability
Cisco ASA Authenticated Linux Shell Access Vulnerability
A vulnerability in the Virtual Network Management Center (VNMC) policy code of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, local attacker to access the underlying Linux operating system with the privileges of the root user.
The vulnerability is due to insufficient sanitization of user supplied input. An attacker could exploit this vulnerability by logging in to an affected system as administrator, copying a malicious script onto the disk, and executing the script.
Cisco has confirmed the vulnerability in a security advisory and released software updates.
To exploit the vulnerability, the attacker must log in locally to the affected device with administrative privileges. The required privileges
Cisco
Multiple Vulnerabilities in Cisco ASA Software
vendor_cisco·2014-10-08·CVSS 7.8
CVE-2014-3382 [HIGH] CWE-16 Multiple Vulnerabilities in Cisco ASA Software
Multiple Vulnerabilities in Cisco ASA Software
2015-July-08 UPDATE: Cisco PSIRT is aware of disruption to some
Cisco customers with Cisco ASA devices affected by CVE-2014-3383, the
Cisco ASA VPN Denial of Service Vulnerability that was disclosed in this
Security Advisory. Traffic causing the disruption was isolated to a
specific source IPv4 address. Cisco has engaged the provider and owner
of that device and determined that the traffic was sent with no
malicious intent. Cisco strongly recommends that customers upgrade to a
fixed Cisco ASA software release to remediate this issue.
Cisco Adaptive Security Appliance (ASA) Software is affected by the following vulnerabilities:
Cisco ASA SQL*NET Inspection Engine Denial of Service Vulnerability
Cisco ASA VPN Denial of Service Vulnerability
C
Cisco
Multiple Vulnerabilities in Cisco ASA Software
vendor_cisco
CVE-2014-3390 Multiple Vulnerabilities in Cisco ASA Software
CVE-2014-3390: Multiple Vulnerabilities in Cisco ASA Software
2015-July-08 UPDATE: Cisco PSIRT is aware of disruption to some Cisco customers with Cisco ASA devices affected by CVE-2014-3383, the Cisco ASA VPN Denial of Service Vulnerability that was disclosed in this Security Advisory. Traffic causing the disruption was isolated to a specific source IPv4 address. Cisco has engaged the provider and owner of that device and determined that the traffic was sent with no malicious intent. Cisco strongly recommends that customers upgrade to a fixed Cisco ASA software release to remediate this issue. Cisco Adaptive Security Appliance (ASA) Software is affected by the following vulnerabilities: Cisco ASA SQL*NET Inspection Engine Denial of Service Vulnerability Cisco ASA VPN Denial of Service Vul
GHSA
GHSA-qgf8-qpr9-cgfr: The Virtual Network Management Center (VNMC) policy implementation in Cisco ASA Software 8
ghsa_unreviewed·2022-05-17
CVE-2014-3390 [MEDIUM] CWE-20 GHSA-qgf8-qpr9-cgfr: The Virtual Network Management Center (VNMC) policy implementation in Cisco ASA Software 8
The Virtual Network Management Center (VNMC) policy implementation in Cisco ASA Software 8.7 before 8.7(1.14), 9.2 before 9.2(2.8), and 9.3 before 9.3(1.1) allows local users to obtain Linux root access by leveraging administrative privileges and executing a crafted script, aka Bug IDs CSCuq41510 and CSCuq47574.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2014-10-10
Published