CVE-2014-3384: High severity cisco asa software vulnerability

Published Oct 10, 2014

Updated

The IKEv2 implementation in Cisco ASA Software 8.4 before 8.4(7.15), 8.6 before 8.6(1.14), 9.0 before 9.0(4.8), and 9.1 before 9.1(5.1) allows remote attackers to cause a denial of service (device reload) via a crafted packet that is sent during tunnel creation, aka Bug ID CSCum96401.

Affected Software

10 affected components

Cisco ASA=8.4

Cisco ASA=8.4.1

Cisco ASA=8.4.2

Cisco ASA=8.4.3

Cisco ASA=8.4.4

Cisco ASA=8.6

Cisco ASA=8.6.1

Cisco ASA=9.0

Cisco ASA=9.1

Cisco ASA=9.1.5

Event History

Oct 10, 2014

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-3384?

CVE-2014-3384 has a High severity rating due to its potential to allow remote attackers to cause a denial of service.

How do I fix CVE-2014-3384?

To fix CVE-2014-3384, update Cisco ASA Software to the fixed versions: 8.4(7.15), 8.6(1.14), 9.0(4.8), or 9.1(5.1) or later.

What impact does CVE-2014-3384 have on affected Cisco ASA versions?

CVE-2014-3384 can cause a device reload, leading to a denial of service during IKEv2 tunnel creation.

Which Cisco ASA software versions are vulnerable to CVE-2014-3384?

Vulnerable versions include Cisco ASA Software 8.4 before 8.4(7.15), 8.6 before 8.6(1.14), 9.0 before 9.0(4.8), and 9.1 before 9.1(5.1).

Who can exploit CVE-2014-3384?

CVE-2014-3384 can be exploited by remote attackers sending crafted packets to the affected Cisco ASA devices.