CVE-2014-3407
published 2014-11-28CVE-2014-3407: The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.3(.2) and earlier does not properly allocate memory blocks during HTTP packet…
PriorityP424medium5CVSS 2.0
AVNACLAuNCNINAP
EPSS
1.70%
74.6th percentile
The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.3(.2) and earlier does not properly allocate memory blocks during HTTP packet handling, which allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCuq68888.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | adaptive_security_appliance_software | <= 9.3\(2\) | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
vendor_cisco5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco ASA Software SSL VPN Memory Blocks Exhaustion Vulnerability
vendor_cisco·2014-11-26·CVSS 5.0
CVE-2014-3407 [MEDIUM] CWE-399 Cisco ASA Software SSL VPN Memory Blocks Exhaustion Vulnerability
Cisco ASA Software SSL VPN Memory Blocks Exhaustion Vulnerability
A vulnerability in the SSL VPN feature of Cisco ASA Software could
allow an unauthenticated, remote attacker to cause the exhaustion of
available memory, which could lead to system instability and availability
issues on the SSL VPN services.
The vulnerability is due to improper implementation of memory block
allocation when processing crafted HTTP packets. An attacker could
exploit this vulnerability by sending a crafted HTTP packet to the
affected system. The vulnerability can be exploited if SSL VPN is enabled.
Cisco has confirmed the vulnerability in a security notice and released software updates.
To exploit this vulnerability, an attacker may need to acquire additional information about the targeted device, such as
GHSA
GHSA-wcpx-v8vr-h5cw: The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9
ghsa_unreviewed·2022-05-17
CVE-2014-3407 [MEDIUM] CWE-400 GHSA-wcpx-v8vr-h5cw: The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9
The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.3(.2) and earlier does not properly allocate memory blocks during HTTP packet handling, which allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCuq68888.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2014-11-28
Published