what you don't know can hurt you

Cisco Security Advisory 20160518-wsa4

Cisco Security Advisory 20160518-wsa4
Posted May 18, 2016
Authored by Cisco Systems | Site cisco.com

Cisco Security Advisory - A vulnerability in Cisco AsyncOS for the Cisco Web Security Appliance (WSA) when the software handles a specific HTTP response code could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an appliance because the appliance runs out of system memory. The vulnerability occurs because the software does not free client and server connection memory and system file descriptors when a certain HTTP response code is received in the HTTP request. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. An exploit could allow the attacker to cause a DoS condition because the appliance runs out of system memory. When this happens, the device can no longer accept new incoming connection requests. Cisco has released software updates that address this vulnerability. A workaround that addresses this vulnerability is also available.

tags | advisory, remote, web, denial of service
systems | cisco
MD5 | f109c49e8441a7f22c491e7bff1607d9

Cisco Security Advisory 20160518-wsa4

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Cisco Web Security Appliance Connection Denial of Service Vulnerability

Advisory ID: cisco-sa-20160518-wsa4

Revision 1.0

For Public Release 2016 May 18 16:00 UTC (GMT)

+---------------------------------------------------------------------

Summary
=======

A vulnerability in Cisco AsyncOS for the Cisco Web Security Appliance (WSA) when the software handles a specific HTTP response code could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an appliance because the appliance runs out of system memory.

The vulnerability occurs because the software does not free client and server connection memory and system file descriptors when a certain HTTP response code is received in the HTTP request. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. An exploit could allow the attacker to cause a DoS condition because the appliance runs out of system memory. When this happens, the device can no longer accept new incoming connection requests.

Cisco has released software updates that address this vulnerability. A workaround that addresses this vulnerability is also available.

This advisory is available at the following link:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160518-wsa4

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (SunOS)

iQIVAwUBVzI0k689gD3EAJB5AQIFTw//SVvwy5A6X4SY/r95dKR7bw6PhsZWlAyI
WkDUis7GTqaGtVQWBDJi4Dv2gzI53/i3y97fXlwqvxv+B/nj6L2AhJjH6j5wWtca
cplmOdDLSYupLp6jO+sQV4HXRMoDLCbLNkXsqSRjPsVPg+5U6DFVDzz2X+B7f1Rs
v6yw7hPpuujq71ZbnqhxNBX4Xl8h6BDzmGOtQq4V76Bjv48lN4ItI0wwpZ9ZShLn
3wky7iAhLZKwOazdYGNE13eyVCBhKHbIHZ3pgG8jkpBHizR/xCwp8K2D94JxTx3u
Gu+9GbFh4y3RQguA6QOCeI2aSThcKC3Ial7+bgnVX3+K9Kqwi3G+/fmjN8dXMxke
Y1FyRs/V9JT8dbVPqPhvE5cghlF3+9XIUiXMDVgkUvG69ZrmvlgPVIMCN55vHzfD
siaoBjyk4FOOzINzIypmnZAkZoyRoTghNQRG4Mc7rzy2dpKN+WYhFEY391i6aU5j
ZeYem0LS+BpFpUv1XrqEsQc6ND46Djsy6tCE30WY1u87QDXG99D9O76q16neM0Kc
qHv/wSZNS3I5hAdLq+JB6OJh31X5ZuiUlFdZumYw3u4fb/ehkjQ98ek2G9YDKMVO
nXMc0Aq8cWidUjP/RWnLFwvSX8TyfP3wuZAPeGk50mz1VhnBE1VzuYUXJKp1fXyc
QHExA8KC4xI=
=4sxz
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

August 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    3 Files
  • 2
    Aug 2nd
    2 Files
  • 3
    Aug 3rd
    32 Files
  • 4
    Aug 4th
    22 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    19 Files
  • 7
    Aug 7th
    6 Files
  • 8
    Aug 8th
    1 Files
  • 9
    Aug 9th
    2 Files
  • 10
    Aug 10th
    27 Files
  • 11
    Aug 11th
    11 Files
  • 12
    Aug 12th
    11 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close