Cisco Adaptive Security Appliance (ASA) Software is the operating system used by the Cisco ASA 5500 Series Adaptive Security Appliances, the Cisco ASA 5500-X Next Generation Firewall, the Cisco ASA Services Module (ASASM) for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, and the Cisco ASA 1000V Cloud Firewall. The Cisco ASA family provides network security services such as firewall, intrusion prevention system (IPS), anti-X, and VPN.A vulnerability in code that handles privilege assignment when the Cisco ASA device is accessed using the Cisco ASDM could allow an authenticated, remote attacker to elevate privileges and gain administrative access to the affected system.The vulnerability is due to improper privilege assignment to users with privilege level 0. An attacker could exploit this vulnerability by logging in to the Cisco ASDM with user credentials with privilege level 0. An exploit could allow the attacker or an unprivileged user to elevate the access privileges and gain administrative access to the affected system.Only traffic destined to the affected device can be used to exploit this vulnerability. This vulnerability affects Cisco ASA Software configured in routed or transparent firewall mode and single or multiple context mode. This vulnerability can be triggered by IP version 4 (IPv4) and IP version 6 (IPv6) traffic. A TCP three-way handshake is needed to exploit this vulnerability.This vulnerability is documented in Cisco bug ID CSCuj33496 registered customers only) and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2014-2126.A vulnerability in the code that handles management session information could allow an authenticated, remote attacker to elevate the assigned privilege and gain administrative access to the affected system.The vulnerability is due to improper validation of user privileges when users are connected to the SSL VPN portal by using the Clientless SSL VPN feature. An attacker could exploit this vulnerability by logging in to the SSL VPN portal and submitting crafted URLs. An exploit could allow the attacker or an unprivileged user to elevate privileges and gain administrative access to the affected system.Only traffic destined to the affected device can be used to exploit this vulnerability. This vulnerability affects Cisco ASA Software configured in routed firewall mode and single context mode only. This vulnerability can be triggered by IPv4 and IPv6 traffic. A TCP three-way handshake is needed to exploit this vulnerability.This vulnerability is documented in Cisco bug ID CSCul70099 registered customers only) and has been assigned CVE ID CVE-2014-2127.

A vulnerability in the SSL VPN code could allow an unauthenticated, remote attacker to access the SSL VPN portal web page.

The vulnerability is due to improper handling of authentication cookies when the Cisco ASA SSL VPN feature is enabled. An attacker could exploit this vulnerability by manually modifying the HTTP POST body with a forged cookie value or entering a crafted URL. An exploit could allow the attacker to gain unauthenticated access to the SSL VPN Portal page. Depending on the SSL VPN configuration, the attacker may also start a VPN tunnel by using Cisco AnyConnect.In all cases, the attacker may gain unauthorized access to internal network resources.Only traffic destined to the affected device can be used to exploit this vulnerability. This vulnerability affects Cisco ASA Software configured in routed firewall mode and single context mode only. This vulnerability can be triggered by IPv4 and IPv6 traffic. A TCP three-way handshake is needed to exploit this vulnerability.This vulnerability is documented in Cisco bug ID CSCua85555 registered customers only) and has been assigned CVE ID CVE-2014-2128.

A vulnerability in the SIP inspection engine code could allow an unauthenticated, remote attacker to exhaust available memory, which may cause instability or a reload of the affected system.

The vulnerability is due to improper handling of SIP packets inspected by the Cisco ASA SIP inspection engine. An attacker could exploit this vulnerability by sending crafted SIP packets through the affected system. An exploit could allow the attacker to cause the exhaustion of available memory. This may cause system instability and in some cases lead to a reload of the affected system, creating a denial of service condition.Only transit traffic that is inspected by the Cisco ASA SIP inspection engine can be used to exploit this vulnerability. This vulnerability affects Cisco ASA Software configured in routed and transparent firewall mode and single or multiple context mode. This vulnerability can be triggered by IPv4 and IPv6 traffic.This vulnerability is documented in Cisco bug ID CSCuh44052 registered customers only) and has been assigned CVE ID CVE-2014-2129.