CVE-2014-3388

Vulnerability

The DNS inspection engine in Cisco ASA Software versions 9.0 before 9.0(4.13), 9.1 before 9.1(5.7), and 9.2 before 9.2(2) contains a vulnerability that allows remote attackers to cause a denial of service via crafted DNS packets [1]. The DNS inspection feature is used to inspect DNS traffic passing through the ASA.

Exploitation

An attacker can exploit this vulnerability by sending specially crafted DNS packets to an affected Cisco ASA device. No authentication is required, and the attacker does not need any prior access. The crafted packets trigger a flaw in the DNS inspection engine, leading to a device reload [1].

Impact

Successful exploitation results in a denial of service condition, causing the Cisco ASA to reload. This disrupts all traffic passing through the device, including VPN connections and firewall services. There is no impact on confidentiality or integrity [1].

Mitigation

Cisco has released software updates to address this vulnerability. The fixed versions are 9.0(4.13), 9.1(5.7), and 9.2(2) and later [1]. As a workaround, administrators may consider disabling DNS inspection if it is not required for their environment, though this may impact functionality. The advisory recommends upgrading to the fixed release.