CVE-2014-3389

Vulnerability

The VPN implementation in Cisco ASA Software versions 7.2 before 7.2(5.15), 8.2 before 8.2(5.51), 8.3 before 8.3(2.42), 8.4 before 8.4(7.23), 8.6 before 8.6(1.15), 9.0 before 9.0(4.24), 9.1 before 9.1(5.12), 9.2 before 9.2(2.6), and 9.3 before 9.3(1.1) fails to properly implement a tunnel filter. This flaw allows crafted packets to bypass intended access controls [1]. The vulnerability is present when the device is configured to terminate IKEv1 or IKEv2 VPN connections, including LAN-to-LAN, Remote Access IPSec, and L2TP over IPSec VPNs; Clientless or AnyConnect SSL VPNs are not affected [1].

Exploitation

An attacker must be a remote authenticated VPN user. By sending specially crafted packets through the VPN tunnel, the attacker can trigger the tunnel filter bypass. No additional privileges or local access are required beyond authenticated VPN connectivity [1]. The exploit does not require user interaction from other parties.

Impact

Successful exploitation enables the attacker to obtain failover-unit access on the affected Cisco ASA device. This can lead to unauthorized access to sensitive network segments or resources that should be restricted by the tunnel filter, potentially compromising confidentiality and integrity of network traffic [1].

Mitigation

Cisco has released fixed software versions: 7.2(5.15), 8.2(5.51), 8.3(2.42), 8.4(7.23), 8.6(1.15), 9.0(4.24), 9.1(5.12), 9.2(2.6), and 9.3(1.1) [1]. Administrators should upgrade to these or later versions. There is no known workaround for this vulnerability. The issue is tracked as Bug ID CSCuq28582 [1].