exploit the possibilities

Cisco Security Advisory 20160518-wsa2

Cisco Security Advisory 20160518-wsa2
Posted May 18, 2016
Authored by Cisco Systems | Site cisco.com

Cisco Security Advisory - A vulnerability in the cached file-range request functionality of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an appliance due to the appliance running out of system memory. The vulnerability is due to a failure to free memory when a file range for cached content is requested through the WSA. An attacker could exploit this vulnerability by opening multiple connections that request file ranges through the affected device. A successful exploit could allow the attacker to cause the WSA to stop passing traffic when enough memory is used and not freed. Cisco has released software updates that address this vulnerability. A workaround that mitigates this vulnerability is also available.

tags | advisory, remote, web, denial of service
systems | cisco
MD5 | ab94bbce330aea9d4c630cde02965601

Cisco Security Advisory 20160518-wsa2

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Cisco Web Security Appliance Cached Range Request Denial of Service Vulnerability

Advisory ID: cisco-sa-20160518-wsa2

Revision 1.0

For Public Release 2016 May 18 16:00 UTC (GMT)

+---------------------------------------------------------------------

Summary
=======

A vulnerability in the cached file-range request functionality of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an appliance due to the appliance running out of system memory.

The vulnerability is due to a failure to free memory when a file range for cached content is requested through the WSA. An attacker could exploit this vulnerability by opening multiple connections that request file ranges through the affected device. A successful exploit could allow the attacker to cause the WSA to stop passing traffic when enough memory is used and not freed.

Cisco has released software updates that address this vulnerability. A workaround that mitigates this vulnerability is also available.

This advisory is available at the following link:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160518-wsa2

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (SunOS)

iQIVAwUBVzI0Oa89gD3EAJB5AQJsexAAyH61to/tiXUbPHahnr2DdLqJPCkMKyZx
7t6DJRtvD1yBbOPNm+EaySBI7dAIZ9Gtt6kWueARIo9Kyu46Y4TfLpI9Kh8XEGcd
6kB+WO6Ps2FYktDPk0onhr4L8KAMqP05l02Cls7WCkxbc6feOD6GnlWLeIQDFgxB
gaOph4ng1mbmniqBf7bIdsjM1wzx0T58QeNmkCBl3PqPX30GATCVlKwvh2wTqqAR
7PGH+vy47ueTXQgaoFF8NJR/25WhCSnRxBFgotGx+BKPWlE5tAxCC+AQ516md6nn
ox+3UJ0tVDwBV/0gpMLoMN/oqC7VQATjEFiq/vaJDIXipqFw7BJu/qvFfP0gzWRz
MB1S/kAPBbGI8TbV7ago5DM/w0kvtqFlOwYntQhcL3xu6FHq6Wf71HB1R2vqBBkh
qrmPwZ6F3EJmbjwK0GNDzpqIHtTp6yeLGtyXsokbhmh68sCej4JemOgPGXM1aLCP
pFJbaMsHEge3Co9h3TPoq7eXl1JFGOwxb47++/K6oFLvPNUp8f5SqsVtLPGhsGMz
VGhM6XaioppOGjOAGKloyrYfJTMoKcB7OHjnA0bx9MUavN8+epa1s+CH8ViD0iTN
STuvrv8vF+YsIOuD1oCgLLegPZqjNhZPj/ZD9oyvjim34bgoSynAUcY1CiVNyp8/
zsX1HnOZJbo=
=XrBA
-----END PGP SIGNATURE-----

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

April 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    21 Files
  • 2
    Apr 2nd
    35 Files
  • 3
    Apr 3rd
    21 Files
  • 4
    Apr 4th
    16 Files
  • 5
    Apr 5th
    15 Files
  • 6
    Apr 6th
    1 Files
  • 7
    Apr 7th
    2 Files
  • 8
    Apr 8th
    23 Files
  • 9
    Apr 9th
    19 Files
  • 10
    Apr 10th
    15 Files
  • 11
    Apr 11th
    14 Files
  • 12
    Apr 12th
    11 Files
  • 13
    Apr 13th
    2 Files
  • 14
    Apr 14th
    5 Files
  • 15
    Apr 15th
    14 Files
  • 16
    Apr 16th
    19 Files
  • 17
    Apr 17th
    19 Files
  • 18
    Apr 18th
    8 Files
  • 19
    Apr 19th
    4 Files
  • 20
    Apr 20th
    5 Files
  • 21
    Apr 21st
    1 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close