Executive Summary
Summary | |
---|---|
Title | Cisco Web Security Appliance Range Request Denial of Service Vulnerability |
Informations | |||
---|---|---|---|
Name | cisco-sa-20151104-wsa2 | First vendor Publication | 2015-11-04 |
Vendor | Cisco | Last vendor Modification | 2015-11-04 |
Severity (Vendor) | N/A | Revision | 1.0 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:C) | |||
---|---|---|---|
Cvss Base Score | 7.8 | Attack Range | Network |
Cvss Impact Score | 6.9 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
A vulnerability in the file-range request functionality of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an appliance because the appliance runs out of system memory. The vulnerability is due to a failure to free memory when a file range is requested through the Cisco WSA. An attacker could exploit this vulnerability by opening multiple connections that request file ranges through the WSA. A successful exploit could allow the attacker to cause the WSA to stop passing traffic when enough memory is used and not freed. Cisco has released software updates that address this vulnerability. A workaround that mitigates this vulnerability is also available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151104-wsa2 BEGIN PGP SIGNATURE Version: GnuPG v1.4.5 (SunOS) iQIVAwUBVjU+hopI1I6i1Mx3AQJRcg/+NIdwN6LOVr8XeSlK2mFK1ixg1ZbsyKeO TCmiSNBpsGf0wHxPWY9qewUHMSkhxZaVvu7szc24EcA5bWbjuexc0scxRFLuU7Nm LyDjmwRmKr/HVUvXg4wYnWT8y3VtijqVSTZSBnjskZGh4LO/095hZblYEas55Jzk QfHuTH554H7IB6zYOoZdbEOCC0CNzl9AyGAuJAmrZ/udlaQs18nurJR9OSayAltM 7sTxH6SIqFyEy2/+8yqpvUEqMNocYqrEasLjbxR0o73vdlJ9wcOKtyPUpcEioRN3 7BqnYiqPurnBZt+CkBbu5ehgq+0wYdFyJfWyrzeNE9LRMD0SyJTrAu68Pvd0e6AS 0TlpCbiSdOrtLm7vl6v+pF6R3sg+Ve7I2v4w7GXjlZapdRN+vEJoObOk2KGot9kV j3BKVy2RFwLgM+HJEvOCYNobQorb7+E72BkkBauBli8BE6pXI6mjvAxpADrYvv5r fxL2enMX0MNtdUKxgV/t8QvAFiFxMf8bV3kfuqRUul+V/MPQF3nbubtebMQruDT +3HhyoxwE1xV9HjEWOgrxpEwW/p4nxalF7RTbywbxllaHsMH8hhJYlyFmKL7jkRL8 VS8Oj6PX0P4MJX5TpCsMk8k0pjLYpnGsH+Jbl+CgkLA59DPeerBDhoBH45FbsCMn 80LINw5zqH8= =TsjI END PGP SIGNATURE _______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com |
Original Source
Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...) |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-399 | Resource Management Errors |
CPE : Common Platform Enumeration
Snort® IPS/IDS
Date | Description |
---|---|
2016-03-14 | Cisco Web Security Appliance range request memory leak denial of service attempt RuleID : 36649 - Revision : 1 - Type : SERVER-OTHER |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2015-11-18 | Name : The remote security appliance is missing a vendor-supplied patch. File : cisco-sa-20151104-aos_wsa.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2015-11-19 13:25:09 |
|
2015-11-06 21:27:34 |
|
2015-11-04 21:17:49 |
|