CVE Vulnerabilities

CVE-2014-3402

Improper Authentication

Published: Oct 10, 2014 | Modified: Oct 15, 2014
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
Ubuntu

The authentication-manager process in the web framework in Cisco Intrusion Prevention System (IPS) 7.0(8)E4 and earlier in Cisco Intrusion Detection System (IDS) does not properly manage user tokens, which allows remote attackers to cause a denial of service (temporary MainApp hang) via a crafted connection request to the management interface, aka Bug ID CSCuq39550.

Weakness

When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.

Affected Software

Name Vendor Start Version End Version
Intrusion_prevention_system Cisco 7.0 7.0
Intrusion_prevention_system Cisco 7.0(1)e3 7.0(1)e3
Intrusion_prevention_system Cisco 7.0(2)e3 7.0(2)e3
Intrusion_prevention_system Cisco 7.0(2)e4 7.0(2)e4
Intrusion_prevention_system Cisco 7.0(3)e4 7.0(3)e4
Intrusion_prevention_system Cisco 7.0(4)e4 7.0(4)e4
Intrusion_prevention_system Cisco 7.0(5a)e4 7.0(5a)e4
Intrusion_prevention_system Cisco 7.0(6)e4 7.0(6)e4
Intrusion_prevention_system Cisco 7.0(7)e4 7.0(7)e4
Intrusion_prevention_system Cisco * 7.0(8)e4

Potential Mitigations

References