Details of VAR-201408-0155

ID

VAR-201408-0155

CVE

CVE-2014-3331

TITLE

Cisco ASR 5000 Series of software Packet Data Network Gateway of Service disruption in the Session Manager component (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2014-003875

DESCRIPTION

The Session Manager component in Packet Data Network Gateway (aka PGW) in Cisco ASR 5000 Series Software 11.0, 12.0, 12.1, 12.2, 14.0, 15.0, 16.x through 16.1.2, and 17.0 allows remote attackers to cause a denial of service (process crash) via a crafted TCP packet, aka Bug ID CSCuo21914. The Cisco ASR 5000 Series is a carrier-grade platform for deploying high-demand 3G networks and migrating to Long Term Evolution (LTE). Cisco ASR 5000 Series Software is prone to a denial-of-service vulnerability. This issue is being tracked by Cisco Bug ID CSCuo21914. Packet Data Network Gateway (aka PGW) is one of the packet data gateways

Trust: 2.52

sources: NVD: CVE-2014-3331 // JVNDB: JVNDB-2014-003875 // CNVD: CNVD-2014-05130 // BID: 69281 // VULHUB: VHN-71271

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2014-05130

AFFECTED PRODUCTS

vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	11.0	Trust: 2.4
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	12.0	Trust: 2.4
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	12.1	Trust: 2.4
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	12.2	Trust: 2.4
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	14.0	Trust: 2.4
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	15.0	Trust: 2.4
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	17.0.0	Trust: 1.6
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	16.1.0	Trust: 1.6
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	16.1.2	Trust: 1.6
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	16.1.1	Trust: 1.6
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	16.1.2 for up to 16.x	Trust: 0.8
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	17.0	Trust: 0.8
vendor:	cisco	model:	asr series	scope:	eq	version:	5000	Trust: 0.6

sources: CNVD: CNVD-2014-05130 // JVNDB: JVNDB-2014-003875 // CNNVD: CNNVD-201408-318 // NVD: CVE-2014-3331

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2014-3331
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2014-3331
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2014-05130
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201408-318
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-71271
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2014-3331
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2014-05130
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-71271
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: CNVD: CNVD-2014-05130 // VULHUB: VHN-71271 // JVNDB: JVNDB-2014-003875 // CNNVD: CNNVD-201408-318 // NVD: CVE-2014-3331

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.9

sources: VULHUB: VHN-71271 // JVNDB: JVNDB-2014-003875 // NVD: CVE-2014-3331

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201408-318

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201408-318

CONFIGURATIONS

sources: JVNDB: JVNDB-2014-003875

PATCH

title:	Cisco Packet Data Network Gateway Denial of Service Vulnerability	url:	http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3331	Trust: 0.8
title:	35346	url:	http://tools.cisco.com/security/center/viewAlert.x?alertId=35346	Trust: 0.8
title:	Patch for Cisco ASR 5000 Series Software Denial of Service Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/49139	Trust: 0.6

sources: CNVD: CNVD-2014-05130 // JVNDB: JVNDB-2014-003875

EXTERNAL IDS

db:	NVD	id:	CVE-2014-3331	Trust: 3.4
db:	BID	id:	69281	Trust: 2.0
db:	SECUNIA	id:	60706	Trust: 1.1
db:	SECTRACK	id:	1030747	Trust: 1.1
db:	JVNDB	id:	JVNDB-2014-003875	Trust: 0.8
db:	CNNVD	id:	CNNVD-201408-318	Trust: 0.7
db:	CNVD	id:	CNVD-2014-05130	Trust: 0.6
db:	VULHUB	id:	VHN-71271	Trust: 0.1

sources: CNVD: CNVD-2014-05130 // VULHUB: VHN-71271 // BID: 69281 // JVNDB: JVNDB-2014-003875 // CNNVD: CNNVD-201408-318 // NVD: CVE-2014-3331

REFERENCES

url:	http://www.securityfocus.com/bid/69281	Trust: 1.7
url:	http://tools.cisco.com/security/center/content/ciscosecuritynotice/cve-2014-3331	Trust: 1.7
url:	http://tools.cisco.com/security/center/viewalert.x?alertid=35346	Trust: 1.7
url:	http://www.securitytracker.com/id/1030747	Trust: 1.1
url:	http://secunia.com/advisories/60706	Trust: 1.1
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/95357	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-3331	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-3331	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3

sources: CNVD: CNVD-2014-05130 // VULHUB: VHN-71271 // BID: 69281 // JVNDB: JVNDB-2014-003875 // CNNVD: CNNVD-201408-318 // NVD: CVE-2014-3331

CREDITS

Cisco

Trust: 0.3

sources: BID: 69281

SOURCES

db:	CNVD	id:	CNVD-2014-05130
db:	VULHUB	id:	VHN-71271
db:	BID	id:	69281
db:	JVNDB	id:	JVNDB-2014-003875
db:	CNNVD	id:	CNNVD-201408-318
db:	NVD	id:	CVE-2014-3331

LAST UPDATE DATE

2024-11-23T22:49:26.539000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2014-05130	date:	2014-08-21T00:00:00
db:	VULHUB	id:	VHN-71271	date:	2017-08-29T00:00:00
db:	BID	id:	69281	date:	2014-08-21T00:12:00
db:	JVNDB	id:	JVNDB-2014-003875	date:	2014-08-22T00:00:00
db:	CNNVD	id:	CNNVD-201408-318	date:	2014-08-21T00:00:00
db:	NVD	id:	CVE-2014-3331	date:	2024-11-21T02:07:52.940

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2014-05130	date:	2014-08-21T00:00:00
db:	VULHUB	id:	VHN-71271	date:	2014-08-20T00:00:00
db:	BID	id:	69281	date:	2014-08-19T00:00:00
db:	JVNDB	id:	JVNDB-2014-003875	date:	2014-08-22T00:00:00
db:	CNNVD	id:	CNNVD-201408-318	date:	2014-08-21T00:00:00
db:	NVD	id:	CVE-2014-3331	date:	2014-08-20T11:17:14.250