CVE-2014-3387: High severity cisco asa software vulnerability

Published Oct 10, 2014

Updated

The SunRPC inspection engine in Cisco ASA Software 7.2 before 7.2(5.14), 8.2 before 8.2(5.51), 8.3 before 8.3(2.42), 8.4 before 8.4(7.23), 8.5 before 8.5(1.21), 8.6 before 8.6(1.14), 8.7 before 8.7(1.13), 9.0 before 9.0(4.5), and 9.1 before 9.1(5.3) allows remote attackers to cause a denial of service (device reload) via crafted SunRPC packets, aka Bug ID CSCun11074.

Affected Software

27 affected components

Cisco ASA=7.2.5

Cisco ASA=7.2.5.10

Cisco ASA=8.2.5

Cisco ASA=8.2.5.13

Cisco ASA=8.2.5.22

Cisco ASA=8.2.5.26

Cisco ASA=8.2.5.33

Cisco ASA=8.2.5.41

Cisco ASA=8.2.5.46

Cisco ASA=8.2.5.48

Cisco ASA=8.2.5.49

Cisco ASA=8.3

Cisco ASA=8.3.2.25

Cisco ASA=8.4

Cisco ASA=8.4.1

Cisco ASA=8.4.2

Cisco ASA=8.4.3

Cisco ASA=8.4.4

Cisco ASA=8.4.5

Cisco ASA=8.4.6

Cisco ASA=8.4.7

Cisco ASA=8.5

Cisco ASA=8.5.1.6

Cisco ASA=8.6

Cisco ASA=8.7

Cisco ASA=9.0

Cisco ASA=9.1

Event History

Oct 10, 2014

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-3387?

CVE-2014-3387 has a CVSS score that indicates it is a medium severity vulnerability.

How do I fix CVE-2014-3387?

To address CVE-2014-3387, you should upgrade to the latest version of Cisco ASA Software that is not affected by this vulnerability.

What types of attacks can CVE-2014-3387 enable?

CVE-2014-3387 allows remote attackers to cause a denial of service, impacting the availability of the affected Cisco ASA devices.

Which Cisco ASA versions are affected by CVE-2014-3387?

CVE-2014-3387 affects various versions of Cisco ASA Software, including versions 7.2 and onward up to certain fixed releases.

Is there a workaround for CVE-2014-3387?

There is no official workaround for CVE-2014-3387; the recommended solution is to apply the necessary software updates.