CVE-2014-3397 Denial of service in n/a

What is CVE-2014-3397?

CVE-2014-3397 is a high-severity denial of service vulnerability in n/a, published on 19 Oct 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The network stack in Cisco TelePresence MCU Software before 4.3(2.30) allows remote attackers to cause a denial of service (memory consumption) via crafted TCP packets, aka Bug ID CSCtz35468.

Weakness: CWE-399

Which versions are affected by CVE-2014-3397?

It affects 1 product.

Products include Cisco Telepresence Mcu Software.

How do I fix CVE-2014-3397?

No fix has been published for CVE-2014-3397 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2014-3397 being exploited?

There is no known exploitation of CVE-2014-3397 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2017-3792 Memory corruption in Cisco TelePresence Multipoint Control Unit (MCU) software version 4.3(1.68) or later configured for Passthrough content mode Critical 9.8
• CVE-2015-4257 Cross-site request forgery in n/a Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-689q-3f4w-rv3r.