var-201402-0221
Vulnerability from variot
Race condition in the Phone Proxy component in Cisco Adaptive Security Appliance (ASA) Software 9.1(.3) and earlier allows remote attackers to bypass sec_db authentication and provide certain pass-through services to untrusted devices via a crafted configuration-file TFTP request, aka Bug ID CSCuj66766. Cisco Adaptive Security Appliance (ASA) is prone to a security-bypass vulnerability. Successfully exploiting this issue will allow attackers to bypass security restrictions and pass traffic from an untrusted phone through the ASA. This issue is tracked by Cisco Bug ID's CSCuj66766
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", affected_products: { "@id": "https://www.variotdbs.pl/ref/affected_products", }, configurations: { "@id": "https://www.variotdbs.pl/ref/configurations", }, credits: { "@id": "https://www.variotdbs.pl/ref/credits", }, cvss: { "@id": "https://www.variotdbs.pl/ref/cvss/", }, description: { "@id": "https://www.variotdbs.pl/ref/description/", }, exploit_availability: { "@id": "https://www.variotdbs.pl/ref/exploit_availability/", }, external_ids: { "@id": "https://www.variotdbs.pl/ref/external_ids/", }, iot: { "@id": "https://www.variotdbs.pl/ref/iot/", }, iot_taxonomy: { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/", }, patch: { "@id": "https://www.variotdbs.pl/ref/patch/", }, problemtype_data: { "@id": "https://www.variotdbs.pl/ref/problemtype_data/", }, references: { "@id": "https://www.variotdbs.pl/ref/references/", }, sources: { "@id": "https://www.variotdbs.pl/ref/sources/", }, sources_release_date: { "@id": "https://www.variotdbs.pl/ref/sources_release_date/", }, sources_update_date: { "@id": "https://www.variotdbs.pl/ref/sources_update_date/", }, threat_type: { "@id": "https://www.variotdbs.pl/ref/threat_type/", }, title: { "@id": "https://www.variotdbs.pl/ref/title/", }, type: { "@id": "https://www.variotdbs.pl/ref/type/", }, }, "@id": "https://www.variotdbs.pl/vuln/VAR-201402-0221", affected_products: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { model: "adaptive security appliance software", scope: "eq", trust: 1, vendor: "cisco", version: "9.1\\(3\\)", }, { model: "adaptive security appliance software", scope: "lte", trust: 0.8, vendor: "cisco", version: "9.1(.3)", }, { model: "adaptive security appliance software", scope: "eq", trust: 0.6, vendor: "cisco", version: "9.1\\(.3\\)", }, ], sources: [ { db: "JVNDB", id: "JVNDB-2014-001457", }, { db: "NVD", id: "CVE-2014-0739", }, { db: "CNNVD", id: "CNNVD-201402-324", }, ], }, configurations: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", children: { "@container": "@list", }, cpe_match: { "@container": "@list", }, data: { "@container": "@list", }, nodes: { "@container": "@list", }, }, data: [ { CVE_data_version: "4.0", nodes: [ { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:o:cisco:adaptive_security_appliance_software:9.1\\(3\\):*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, ], }, ], sources: [ { db: "NVD", id: "CVE-2014-0739", }, ], }, credits: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Cisco", sources: [ { db: "BID", id: "65707", }, ], trust: 0.3, }, cve: "CVE-2014-0739", cvss: { "@context": { cvssV2: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2", }, cvssV3: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/", }, severity: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#", }, "@id": "https://www.variotdbs.pl/ref/cvss/severity", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { cvssV2: [ { acInsufInfo: false, accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", author: "NVD", availabilityImpact: "NONE", baseScore: 4.3, confidentialityImpact: "NONE", exploitabilityScore: 8.6, impactScore: 2.9, integrityImpact: "PARTIAL", obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, severity: "MEDIUM", trust: 1, userInteractionRequired: false, vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N", version: "2.0", }, { acInsufInfo: null, accessComplexity: "Medium", accessVector: "Network", authentication: "None", author: "NVD", availabilityImpact: "None", baseScore: 4.3, confidentialityImpact: "None", exploitabilityScore: null, id: "CVE-2014-0739", impactScore: null, integrityImpact: "Partial", obtainAllPrivilege: null, obtainOtherPrivilege: null, obtainUserPrivilege: null, severity: "Medium", trust: 0.8, userInteractionRequired: null, vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N", version: "2.0", }, { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", author: "VULHUB", availabilityImpact: "NONE", baseScore: 4.3, confidentialityImpact: "NONE", exploitabilityScore: 8.6, id: "VHN-68232", impactScore: 2.9, integrityImpact: "PARTIAL", severity: "MEDIUM", trust: 0.1, vectorString: "AV:N/AC:M/AU:N/C:N/I:P/A:N", version: "2.0", }, ], cvssV3: [], severity: [ { author: "NVD", id: "CVE-2014-0739", trust: 1.8, value: "MEDIUM", }, { author: "CNNVD", id: "CNNVD-201402-324", trust: 0.6, value: "MEDIUM", }, { author: "VULHUB", id: "VHN-68232", trust: 0.1, value: "MEDIUM", }, ], }, ], sources: [ { db: "VULHUB", id: "VHN-68232", }, { db: "JVNDB", id: "JVNDB-2014-001457", }, { db: "NVD", id: "CVE-2014-0739", }, { db: "CNNVD", id: "CNNVD-201402-324", }, ], }, description: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Race condition in the Phone Proxy component in Cisco Adaptive Security Appliance (ASA) Software 9.1(.3) and earlier allows remote attackers to bypass sec_db authentication and provide certain pass-through services to untrusted devices via a crafted configuration-file TFTP request, aka Bug ID CSCuj66766. Cisco Adaptive Security Appliance (ASA) is prone to a security-bypass vulnerability. \nSuccessfully exploiting this issue will allow attackers to bypass security restrictions and pass traffic from an untrusted phone through the ASA. \nThis issue is tracked by Cisco Bug ID's CSCuj66766", sources: [ { db: "NVD", id: "CVE-2014-0739", }, { db: "JVNDB", id: "JVNDB-2014-001457", }, { db: "BID", id: "65707", }, { db: "VULHUB", id: "VHN-68232", }, ], trust: 1.98, }, external_ids: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { db: "NVD", id: "CVE-2014-0739", trust: 2.8, }, { db: "JVNDB", id: "JVNDB-2014-001457", trust: 0.8, }, { db: "CNNVD", id: "CNNVD-201402-324", trust: 0.7, }, { db: "BID", id: "65707", trust: 0.4, }, { db: "VULHUB", id: "VHN-68232", trust: 0.1, }, ], sources: [ { db: "VULHUB", id: "VHN-68232", }, { db: "BID", id: "65707", }, { db: "JVNDB", id: "JVNDB-2014-001457", }, { db: "NVD", id: "CVE-2014-0739", }, { db: "CNNVD", id: "CNNVD-201402-324", }, ], }, id: "VAR-201402-0221", iot: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: true, sources: [ { db: "VULHUB", id: "VHN-68232", }, ], trust: 0.01, }, last_update_date: "2023-12-18T13:20:00.503000Z", patch: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { title: "Cisco Adaptive Security Appliance Phone Proxy sec_db Race Condition Vulnerability", trust: 0.8, url: "http://tools.cisco.com/security/center/content/ciscosecuritynotice/cve-2014-0739", }, { title: "32955", trust: 0.8, url: "http://tools.cisco.com/security/center/viewalert.x?alertid=32955", }, ], sources: [ { db: "JVNDB", id: "JVNDB-2014-001457", }, ], }, problemtype_data: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { problemtype: "CWE-287", trust: 1.9, }, ], sources: [ { db: "VULHUB", id: "VHN-68232", }, { db: "JVNDB", id: "JVNDB-2014-001457", }, { db: "NVD", id: "CVE-2014-0739", }, ], }, references: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { trust: 1.7, url: "http://tools.cisco.com/security/center/content/ciscosecuritynotice/cve-2014-0739", }, { trust: 1.7, url: "http://tools.cisco.com/security/center/viewalert.x?alertid=32955", }, { trust: 0.8, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0739", }, { trust: 0.8, url: "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-0739", }, { trust: 0.3, url: "http://www.cisco.com/en/us/products/ps6120/index.html", }, ], sources: [ { db: "VULHUB", id: "VHN-68232", }, { db: "BID", id: "65707", }, { db: "JVNDB", id: "JVNDB-2014-001457", }, { db: "NVD", id: "CVE-2014-0739", }, { db: "CNNVD", id: "CNNVD-201402-324", }, ], }, sources: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", data: { "@container": "@list", }, }, data: [ { db: "VULHUB", id: "VHN-68232", }, { db: "BID", id: "65707", }, { db: "JVNDB", id: "JVNDB-2014-001457", }, { db: "NVD", id: "CVE-2014-0739", }, { db: "CNNVD", id: "CNNVD-201402-324", }, ], }, sources_release_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", data: { "@container": "@list", }, }, data: [ { date: "2014-02-22T00:00:00", db: "VULHUB", id: "VHN-68232", }, { date: "2014-02-20T00:00:00", db: "BID", id: "65707", }, { date: "2014-02-25T00:00:00", db: "JVNDB", id: "JVNDB-2014-001457", }, { date: "2014-02-22T21:55:09.750000", db: "NVD", id: "CVE-2014-0739", }, { date: "2014-02-26T00:00:00", db: "CNNVD", id: "CNNVD-201402-324", }, ], }, sources_update_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", data: { "@container": "@list", }, }, data: [ { date: "2019-12-11T00:00:00", db: "VULHUB", id: "VHN-68232", }, { date: "2014-02-25T01:12:00", db: "BID", id: "65707", }, { date: "2014-02-25T00:00:00", db: "JVNDB", id: "JVNDB-2014-001457", }, { date: "2023-08-15T15:14:43.030000", db: "NVD", id: "CVE-2014-0739", }, { date: "2019-12-12T00:00:00", db: "CNNVD", id: "CNNVD-201402-324", }, ], }, threat_type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "remote", sources: [ { db: "CNNVD", id: "CNNVD-201402-324", }, ], trust: 0.6, }, title: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Cisco Adaptive Security Appliance Software Phone Proxy In the component sec_db Vulnerability that bypasses authentication", sources: [ { db: "JVNDB", id: "JVNDB-2014-001457", }, ], trust: 0.8, }, type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "authorization issue", sources: [ { db: "CNNVD", id: "CNNVD-201402-324", }, ], trust: 0.6, }, }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.