CVE-2014-3399

The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.2(.2.4) and earlier does not properly manage session information during creation of a SharePoint handler, which allows remote authenticated users to overwrite arbitrary RAMFS cache files or inject Lua programs, and consequently cause a denial of service (portal outage or system reload), via crafted HTTP requests, aka Bug ID CSCup54208.
Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*

History

21 Nov 2024, 02:08

Type Values Removed Values Added
References () http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3399 - Broken Link, Vendor Advisory () http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3399 - Broken Link, Vendor Advisory
References () http://tools.cisco.com/security/center/viewAlert.x?alertId=35989 - Vendor Advisory () http://tools.cisco.com/security/center/viewAlert.x?alertId=35989 - Vendor Advisory

Information

Published : 2014-10-07 10:55

Updated : 2024-11-21 02:08


NVD link : CVE-2014-3399

Mitre link : CVE-2014-3399

CVE.ORG link : CVE-2014-3399


JSON object : View

Products Affected

cisco

  • adaptive_security_appliance_software
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')