CVE-2014-3386

Vulnerability

The vulnerability resides in the GPRS Tunneling Protocol (GTP) inspection engine of Cisco ASA Software. Affected versions include 8.2 before 8.2(5.51), 8.4 before 8.4(7.15), 8.7 before 8.7(1.13), 9.0 before 9.0(4.8), and 9.1 before 9.1(5.1). The engine fails to properly handle a crafted series of GTP packets, leading to a device reload. GTP inspection must be enabled for the code path to be reachable. [1]

Exploitation

A remote attacker can send a specially crafted sequence of GTP packets to an affected Cisco ASA device that has GTP inspection enabled. No authentication is required, and the attacker only needs network access to send packets to the device. [1]

Impact

Successful exploitation causes the device to reload, resulting in a denial of service (DoS). The attack does not allow code execution or data leakage; the primary impact is loss of availability. [1]

Mitigation

Cisco has released fixed software versions: 8.2(5.51), 8.4(7.15), 8.7(1.13), 9.0(4.8), and 9.1(5.1). Administrators should upgrade to these or later versions. As a workaround, if GTP inspection is not required, it can be disabled using the no inspect gtp command in the global service policy. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog (KEV) as of the publication date. [1]