Bugtraq: Cisco Security Advisory: Cisco Web Security Appliance HTTP POST Denial of Service Vulnerability

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

Cisco Web Security Appliance HTTP POST Denial of Service Vulnerability

Advisory ID: cisco-sa-20160518-wsa1

Revision 1.0

For Public Release 2016 May 18 16:00 UTC (GMT)

+---------------------------------------------------------------------

Summary

=======

A vulnerability that occurs when parsing an HTTP POST request with Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) vulnerability due to the proxy process becoming unresponsive.

The vulnerability is due to a lack of proper input validation of the packets that make up the HTTP POST request. An attacker could exploit this vulnerability by sending a crafted HTTP POST request to the affected device. An exploit could allow the attacker to cause a DoS condition due to the proxy process becoming unresponsive and the WSA reloading.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:

http://ift.tt/1OA5F6U

co-sa-20160518-wsa1

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.5 (SunOS)

iQIVAwUBVzI0Ga89gD3EAJB5AQJGlg/+ObkX2XT38zQEebob3urvYki7B6X+ymcR

XVObHxksGUQNOsHPmLlj/efiSeBRlr8tD8ZwH5MEm6A2E8R24tnxJJw7A4LxZMm+

TxWSm/eXu7hFQufWnsKcC/zV8G7pFyrDi/9k9//Gqj1RENh5EQQECBqfWs/cCRZM

lNKpwY33V/mar6Qopf+YBuhkUY0vgd0Jz189S2EK5RQndwERvUrMTZHicErsupeb

5hFHP//pjDiu1JusGrU3Vvx+gIlKVCd13Aq1ancqE4EKLlBk7KIgZMnD6dfaEOAt

YYCDBHVTkSmPYltEZ6d4YU7+DmT2fkbK8r3aybeuxRZJ0EWwIq5ssOkzZSgN18tr

itAnftJwGVrOEmaAtxcba7Ok5+Y5B4+031cwRfxruML8ZoEX36KaZy3HDzwGY0su

fuIRp6yucSVohTHgkU+KX3DXlzD/HpviaDdFwMscwyvtKo+vzJZVWkxaQI190B+y

GwwDcIV1EzM58NeXzPtuiR8e2+hUAZ6F1D6Np1lVrVa2VyRcBdQ0BbMr6xuzruWN

Y4j73bK/g7yBO3wXbFYw7vW7pm71jCi6oq1fI0M45XKJPGdAzIVhroCLepNAfvf8

F8pzscWL+8XqDD9NqjUl42jM1sxVCpYGLyVTeGuNdUSGtoKwqsy7X4MdWDcSZ7Wa

rmhFNyj9Vm8=

=kAil

-----END PGP SIGNATURE-----

[ reply ]


from SecurityFocus Vulnerabilities http://ift.tt/1OJqJxl