Vulnerability Description
The Smart Call Home (SCH) implementation in Cisco ASA Software 8.2 before 8.2(5.50), 8.4 before 8.4(7.15), 8.6 before 8.6(1.14), 8.7 before 8.7(1.13), 9.0 before 9.0(4.8), and 9.1 before 9.1(5.1) allows remote attackers to bypass certificate validation via an arbitrary VeriSign certificate, aka Bug ID CSCun10916.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Adaptive Security Virtual Appliance | - |
| Cisco | Adaptive Security Appliance Software | 8.2.0.45 |
| Cisco | Asa 1000V Cloud Firewall | - |
| Cisco | Asa 5505 | - |
| Cisco | Asa 5512-X | - |
| Cisco | Asa 5515-X | - |
| Cisco | Asa 5525-X | - |
| Cisco | Asa 5545-X | - |
| Cisco | Asa 5555-X | - |
| Cisco | Asa 5580 | - |
| Cisco | Asa 5585-X | - |
Related Weaknesses (CWE)
References
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20Vendor Advisory
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20Vendor Advisory
FAQ
What is CVE-2014-3394?
CVE-2014-3394 is a vulnerability with a CVSS score of 5.0 (MEDIUM). The Smart Call Home (SCH) implementation in Cisco ASA Software 8.2 before 8.2(5.50), 8.4 before 8.4(7.15), 8.6 before 8.6(1.14), 8.7 before 8.7(1.13), 9.0 before 9.0(4.8), and 9.1 before 9.1(5.1) allo...
How severe is CVE-2014-3394?
CVE-2014-3394 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-3394?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco Adaptive Security Virtual Appliance, Cisco Adaptive Security Appliance Software, Cisco Asa 1000V Cloud Firewall, Cisco Asa 5505, Cisco Asa 5512-X.