CVE-2014-3385: Race Condition
First published: Fri Oct 10 2014(Updated: )
Race condition in the Health and Performance Monitoring (HPM) for ASDM feature in Cisco ASA Software 8.3 before 8.3(2.42), 8.4 before 8.4(7.11), 8.5 before 8.5(1.19), 8.6 before 8.6(1.13), 8.7 before 8.7(1.11), 9.0 before 9.0(4.8), and 9.1 before 9.1(4.5) allows remote attackers to cause a denial of service (device reload) via TCP traffic that triggers many half-open connections at the same time, aka Bug ID CSCum00556.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco ASA Software | =8.3 | |
| Cisco ASA Software | =8.3.2.25 | |
| Cisco ASA Software | =8.4 | |
| Cisco ASA Software | =8.4.1 | |
| Cisco ASA Software | =8.4.2 | |
| Cisco ASA Software | =8.4.3 | |
| Cisco ASA Software | =8.4.4 | |
| Cisco ASA Software | =8.4.5 | |
| Cisco ASA Software | =8.4.6 | |
| Cisco ASA Software | =8.4.7 | |
| Cisco ASA Software | =8.5 | |
| Cisco ASA Software | =8.5.1.6 | |
| Cisco ASA Software | =8.6 | |
| Cisco ASA Software | =8.7 | |
| Cisco ASA Software | =9.0 | |
| Cisco ASA Software | =9.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2014-3385?
CVE-2014-3385 has a high severity rating, indicating a significant risk to affected systems.
How do I fix CVE-2014-3385?
To fix CVE-2014-3385, upgrade affected Cisco ASA software to the latest versions that are not vulnerable.
What versions of Cisco ASA are affected by CVE-2014-3385?
CVE-2014-3385 affects Cisco ASA software versions prior to 8.3(2.42), 8.4(7.11), 8.5(1.19), 8.6(1.13), 8.7(1.11), 9.0(4.8), and 9.1(4.5).
What type of attack can exploit CVE-2014-3385?
CVE-2014-3385 can be exploited by remote attackers to cause a denial of service on affected devices.
Is there a workaround for CVE-2014-3385?
There is no known effective workaround for CVE-2014-3385; the recommended action is to upgrade the software.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/severity
- agent/weakness
- agent/references
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco asa software
- version/cisco asa software/8.3
- version/cisco asa software/8.3.2.25
- version/cisco asa software/8.4
- version/cisco asa software/8.4.1
- version/cisco asa software/8.4.2
- version/cisco asa software/8.4.3
- version/cisco asa software/8.4.4
- version/cisco asa software/8.4.5
- version/cisco asa software/8.4.6
- version/cisco asa software/8.4.7
- version/cisco asa software/8.5
- version/cisco asa software/8.5.1.6
- version/cisco asa software/8.6
- version/cisco asa software/8.7
- version/cisco asa software/9.0
- version/cisco asa software/9.1