CVE-2014-3385: Race Condition

Published Oct 10, 2014

Updated

Race condition in the Health and Performance Monitoring (HPM) for ASDM feature in Cisco ASA Software 8.3 before 8.3(2.42), 8.4 before 8.4(7.11), 8.5 before 8.5(1.19), 8.6 before 8.6(1.13), 8.7 before 8.7(1.11), 9.0 before 9.0(4.8), and 9.1 before 9.1(4.5) allows remote attackers to cause a denial of service (device reload) via TCP traffic that triggers many half-open connections at the same time, aka Bug ID CSCum00556.

Affected Software

16 affected components

Cisco ASA=8.3

Cisco ASA=8.3.2.25

Cisco ASA=8.4

Cisco ASA=8.4.1

Cisco ASA=8.4.2

Cisco ASA=8.4.3

Cisco ASA=8.4.4

Cisco ASA=8.4.5

Cisco ASA=8.4.6

Cisco ASA=8.4.7

Cisco ASA=8.5

Cisco ASA=8.5.1.6

Cisco ASA=8.6

Cisco ASA=8.7

Cisco ASA=9.0

Cisco ASA=9.1

Event History

Oct 10, 2014

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-3385?

CVE-2014-3385 has a high severity rating, indicating a significant risk to affected systems.

How do I fix CVE-2014-3385?

To fix CVE-2014-3385, upgrade affected Cisco ASA software to the latest versions that are not vulnerable.

What versions of Cisco ASA are affected by CVE-2014-3385?

CVE-2014-3385 affects Cisco ASA software versions prior to 8.3(2.42), 8.4(7.11), 8.5(1.19), 8.6(1.13), 8.7(1.11), 9.0(4.8), and 9.1(4.5).

What type of attack can exploit CVE-2014-3385?

CVE-2014-3385 can be exploited by remote attackers to cause a denial of service on affected devices.

Is there a workaround for CVE-2014-3385?

There is no known effective workaround for CVE-2014-3385; the recommended action is to upgrade the software.