CVE-2015-6293
HighSummary
Cisco AsyncOS versions before 8.0.8-113, 8.1.x before 8.5.3-051, 8.6.x and 8.7.x before 8.7.0-171-LD, and 8.8.x before 8.8.0-085 on Web Security Appliance (WSA) devices allow remote attackers to cause a denial of service (memory consumption) via multiple file-range requests.
Risk Assessment
Attackers can exploit this vulnerability to overload the system, leading to service unavailability of WSA, impacting the security and continuity of the organization's operations.
Recommendation
It is recommended to update Cisco AsyncOS to the latest version to mitigate this vulnerability and to monitor the system for unusual requests.
Other vulnerabilities in Cisco AsyncOS na urządzeniach Web Security Appliance (WSA)
See all- CVE-2016-6407High
Cisco AsyncOS through version 9.5.0-444 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (link saturation) by making many HTTP requests for overlapping byte ranges simultaneously.
- CVE-2016-1382High
Cisco AsyncOS before version 8.5.3-069 and in versions 8.6 through 8.8 on Web Security Appliance (WSA) devices mishandles memory allocation for HTTP requests, allowing remote attackers to cause a denial of service (proxy-process reload) via a crafted request.
- CVE-2016-1380High
Cisco AsyncOS 8.0 before version 8.0.6-119 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (proxy-process hang) via a crafted HTTP POST request.
- CVE-2015-6298High
The admin web interface in Cisco AsyncOS 8.x before version 8.0.8-113, 8.1.x and 8.5.x before 8.5.3-051, 8.6.x and 8.7.x before 8.7.0-171-LD, and 8.8.x before 8.8.0-085 on Web Security Appliance (WSA) devices allows remote authenticated users to obtain root privileges via crafted certificate-generation arguments.
- CVE-2015-6292High
The proxy-cache implementation in Cisco AsyncOS before version 8.0.7-151, 8.5.2-004, 8.7.0-171-LD, and 8.8.0-085 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service via multiple proxy connections.
Original NVD description (English source)
Cisco AsyncOS 8.x before 8.0.8-113, 8.1.x and 8.5.x before 8.5.3-051, 8.6.x and 8.7.x before 8.7.0-171-LD, and 8.8.x before 8.8.0-085 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (memory consumption) via multiple file-range requests, aka Bug ID CSCur39155.