Executive Summary

Summary
Title Cisco Wireless LAN Controller HTTP Parsing Denial of Service Vulnerability
Informations
Name cisco-sa-20160420-htrd First vendor Publication 2016-04-20
Vendor Cisco Last vendor Modification 2016-04-20
Severity (Vendor) N/A Revision 1.0

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 10 Attack Range Network
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A vulnerability in the HTTP URL redirect feature of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to cause a buffer overflow condition on an affected device, resulting in a denial of service (DoS) condition.

The vulnerability is due to improper handling of HTTP traffic by the affected software. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to cause a buffer overflow condition on the device, which could allow the attacker to cause the device to reload, resulting in a DoS condition, or execute arbitrary code on the device.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160420-htrd BEGIN PGP SIGNATURE Comment: GPGTools - https://gpgtools.org

iQIcBAEBCgAGBQJXF4vuAAoJEK89gD3EAJB52hYQALm85XJaGPUEVNKU5qO5XXgS DNXebsZBGXOKiR+4Q/meIrsFfDwSclIXmyK6Xwecxg+ye2thqXyj9oOBIK1svXTb dDb1LixwfvHZGvpjqd38gF6xrzOiGARjuJPlUetWR7IqW1xLiD1Qvx0grf6HFyoC ASpUSKuBRyUs4rYvJ2HewGwgCDVqKWriTZ1ZuyNFkJeiUWRW8IyASkiirTYkDj+g +whHTjdZ5ilzD44aAhdWk+Np7GYom4YAjrhrRdW9kxkSvkTDwsKbZJbBLAXGM2AC GwqxE4Qltw1AbWEJ9w7HXY+SKI0xBhpsm/WBoOfO8kShdT8M0TMxSh8Fga50/C3v 2sZVusZE+3IpqY8CF/1WXYL85sFxNRXhDfae0EiiT1rZSO68zdz48GhuUBllpJT8 AVjupNOg3GWyhFuJzaUlv9sCZT6chwd/J2sRqTNPDelpaMCaLEY5oVeS6noheK1/ VQHAC5DwOer+LR5OmxdG+4ZQbxPSqgFfOxfSxe/pwql3YmWyzFRZQmGkhz05odNH ywalsvEhMJIcJMl9kF4mBLji1hUg6D6XxpxGNEMpfPimiEAQWvKEb/YkC25YtIeZ N9kR4sc7e0NIvysq+2UiIDe1QxdBF6SPZl8HnlYvTsVJ2vBKI+x1uN9dvtFXpW0p fg9E9sebxbEmxJCvhNFi =v8Ma END PGP SIGNATURE _______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com

Original Source

Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...)

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-399 Resource Management Errors

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 17

Nessus® Vulnerability Scanner

Date Description
2016-05-04 Name : The remote device is missing vendor-supplied security patches.
File : cisco-sa-20160420-htrd-bdos-wlc.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
Date Informations
2016-05-05 13:30:52
  • Multiple Updates
2016-04-27 09:42:09
  • Multiple Updates
2016-04-20 21:25:44
  • First insertion