CVE-2016-6407
HighSummary
Cisco AsyncOS through version 9.5.0-444 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (link saturation) by making many HTTP requests for overlapping byte ranges simultaneously.
Risk Assessment
Attackers can exploit this vulnerability to overload the link, leading to service disruptions within the organization.
Recommendation
It is recommended to update Cisco AsyncOS to the latest version to mitigate the risks associated with this vulnerability.
Other vulnerabilities in Cisco AsyncOS na urządzeniach Web Security Appliance (WSA)
See all- CVE-2016-1382High
Cisco AsyncOS before version 8.5.3-069 and in versions 8.6 through 8.8 on Web Security Appliance (WSA) devices mishandles memory allocation for HTTP requests, allowing remote attackers to cause a denial of service (proxy-process reload) via a crafted request.
- CVE-2016-1380High
Cisco AsyncOS 8.0 before version 8.0.6-119 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (proxy-process hang) via a crafted HTTP POST request.
- CVE-2015-6298High
The admin web interface in Cisco AsyncOS 8.x before version 8.0.8-113, 8.1.x and 8.5.x before 8.5.3-051, 8.6.x and 8.7.x before 8.7.0-171-LD, and 8.8.x before 8.8.0-085 on Web Security Appliance (WSA) devices allows remote authenticated users to obtain root privileges via crafted certificate-generation arguments.
- CVE-2015-6292High
The proxy-cache implementation in Cisco AsyncOS before version 8.0.7-151, 8.5.2-004, 8.7.0-171-LD, and 8.8.0-085 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service via multiple proxy connections.
- CVE-2015-6293High
Cisco AsyncOS versions before 8.0.8-113, 8.1.x before 8.5.3-051, 8.6.x and 8.7.x before 8.7.0-171-LD, and 8.8.x before 8.8.0-085 on Web Security Appliance (WSA) devices allow remote attackers to cause a denial of service (memory consumption) via multiple file-range requests.
Original NVD description (English source)
Cisco AsyncOS through 9.5.0-444 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (link saturation) by making many HTTP requests for overlapping byte ranges simultaneously, aka Bug ID CSCuz27219.