Resource exhaustion in Cisco Adaptive Security Appliance Software

CVE-2014-3407

The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.3(.2) and earlier does not properly allocate memory blocks during HTTP packet handling, which allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCuq68888.

Vulnerability class: DoS (Denial of Service)

EPSS: 0.017 (74.8th percentile) — read the EPSS interpretation.

Affected products

Cisco Adaptive_security_appliance_software
N/a — versions n/a

Weakness classification (CWE)

CWE-400 — Uncontrolled Resource Consumption

References

psirt@cisco.com (x_refsource_CONFIRM, Vendor Advisory)
psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Broken Link, Vendor Advisory)