medium5.5
CVE-2014-3399
The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.2(.2.4) and earlier does not properly manage session information during creati…
Impact
The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.2(.2.4) and earlier does not properly manage session information during creation of a SharePoint handler, which allows remote authenticated users to overwrite arbitrary RAMFS cache files or inject Lua programs, and consequently cause a denial of service (portal outage or system reload), via crafted HTTP requests, aka Bug ID CSCup54208.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cisco | Adaptive Security Appliance Software | through 9.2\(2.4\) |
Weakness classification
References
- NVD record
- CVE.org record
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3399
- http://tools.cisco.com/security/center/viewAlert.x?alertId=35989
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3399
- http://tools.cisco.com/security/center/viewAlert.x?alertId=35989