Sign-up

ID

VAR-201601-0054


CVE

CVE-2016-1296


TITLE

Cisco Web Security Vulnerabilities that bypass proxy restrictions in proxy engines running on appliance device software

Trust: 0.8

sources: JVNDB: JVNDB-2016-001315

DESCRIPTION

The proxy engine on Cisco Web Security Appliance (WSA) devices with software 8.5.3-055, 9.1.0-000, and 9.5.0-235 allows remote attackers to bypass intended proxy restrictions via a malformed HTTP method, aka Bug ID CSCux00848. Vendors have confirmed this vulnerability Bug ID CSCux00848 It is released as. Supplementary information : CWE Vulnerability type by CWE-254: Security Features ( Security function ) Has been identified. http://cwe.mitre.org/data/definitions/254.htmlMalformed by a third party HTTP Via a method, proxy restrictions may be bypassed. CiscoWebSecurityAppliancedevices is a set of Web security appliances from Cisco. The device provides SaaS-based access control, real-time network reporting and tracking, and security policy development. An attacker can exploit this issue to bypass security restrictions and perform unauthorized actions. This may aid in further attacks. Proxy engine is one of the proxy engines. The following releases are affected: Cisco WSA Release 8.5.3-055, Release 9.1.0-000, Release 9.5.0-235

Trust: 2.52

sources: NVD: CVE-2016-1296 // JVNDB: JVNDB-2016-001315 // CNVD: CNVD-2016-00453 // BID: 81434 // VULHUB: VHN-90115

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2016-00453

AFFECTED PRODUCTS

vendor:ciscomodel:web security appliancescope:eqversion:8.5.3-055

Trust: 2.5

vendor:ciscomodel:web security appliancescope:eqversion:9.1.0-000

Trust: 2.5

vendor:ciscomodel:web security appliancescope:eqversion:9.5.0-235

Trust: 2.5

vendor:ciscomodel:web security the appliancescope:eqversion:8.5.3-055

Trust: 0.8

vendor:ciscomodel:web security the appliancescope:eqversion:9.1.0-000

Trust: 0.8

vendor:ciscomodel:web security the appliancescope:eqversion:9.5.0-235

Trust: 0.8

sources: CNVD: CNVD-2016-00453 // BID: 81434 // JVNDB: JVNDB-2016-001315 // CNNVD: CNNVD-201601-370 // NVD: CVE-2016-1296

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-1296
value: HIGH

Trust: 1.0

NVD: CVE-2016-1296
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2016-00453
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201601-370
value: MEDIUM

Trust: 0.6

VULHUB: VHN-90115
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2016-1296
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2016-00453
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-90115
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-1296
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.0

Trust: 1.0

sources: CNVD: CNVD-2016-00453 // VULHUB: VHN-90115 // JVNDB: JVNDB-2016-001315 // CNNVD: CNNVD-201601-370 // NVD: CVE-2016-1296

PROBLEMTYPE DATA

problemtype:CWE-254

Trust: 1.1

problemtype:CWE-Other

Trust: 0.8

sources: VULHUB: VHN-90115 // JVNDB: JVNDB-2016-001315 // NVD: CVE-2016-1296

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201601-370

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201601-370

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-001315

PATCH
title:cisco-sa-20160119-wsaurl:http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160119-wsa
Trust: 0.8
title:CiscoWebSecurityAppliancedevices security mechanism bypasses patched vulnerabilitiesurl:https://www.cnvd.org.cn/patchInfo/show/70534
Trust: 0.6
title:Cisco Web Security Appliance Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=59688
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2016-00453 // 
            
            
            
            JVNDB: JVNDB-2016-001315 // 
            
            
            
            CNNVD: CNNVD-201601-370

EXTERNAL IDS
db:NVDid:CVE-2016-1296
Trust: 3.4
db:SECTRACKid:1034763
Trust: 1.1
db:JVNDBid:JVNDB-2016-001315
Trust: 0.8
db:CNNVDid:CNNVD-201601-370
Trust: 0.7
db:CNVDid:CNVD-2016-00453
Trust: 0.6
db:NSFOCUSid:32315
Trust: 0.6
db:BIDid:81434
Trust: 0.4
db:VULHUBid:VHN-90115
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2016-00453 // 
            
            
            
            VULHUB: VHN-90115 // 
            
            
            
            BID: 81434 // 
            
            
            
            JVNDB: JVNDB-2016-001315 // 
            
            
            
            CNNVD: CNNVD-201601-370 // 
            
            
            
            NVD: CVE-2016-1296

REFERENCES
url:http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20160119-wsa
Trust: 2.6
url:http://www.securitytracker.com/id/1034763
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-1296
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-1296
Trust: 0.8
url:http://www.nsfocus.net/vulndb/32315
Trust: 0.6
url:http://www.cisco.com/
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2016-00453 // 
            
            
            
            VULHUB: VHN-90115 // 
            
            
            
            BID: 81434 // 
            
            
            
            JVNDB: JVNDB-2016-001315 // 
            
            
            
            CNNVD: CNNVD-201601-370 // 
            
            
            
            NVD: CVE-2016-1296

CREDITS
Cisco
Trust: 0.3
sources:
            
            
            BID: 81434

SOURCES
db:CNVDid:CNVD-2016-00453
db:VULHUBid:VHN-90115
db:BIDid:81434
db:JVNDBid:JVNDB-2016-001315
db:CNNVDid:CNNVD-201601-370
db:NVDid:CVE-2016-1296

LAST UPDATE DATE
2024-11-23T23:09:13.211000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2016-00453date:2016-01-26T00:00:00
db:VULHUBid:VHN-90115date:2016-12-07T00:00:00
db:BIDid:81434date:2016-01-19T00:00:00
db:JVNDBid:JVNDB-2016-001315date:2016-01-26T00:00:00
db:CNNVDid:CNNVD-201601-370date:2016-01-21T00:00:00
db:NVDid:CVE-2016-1296date:2024-11-21T02:46:08.217

SOURCES RELEASE DATE
db:CNVDid:CNVD-2016-00453date:2016-01-26T00:00:00
db:VULHUBid:VHN-90115date:2016-01-20T00:00:00
db:BIDid:81434date:2016-01-19T00:00:00
db:JVNDBid:JVNDB-2016-001315date:2016-01-26T00:00:00
db:CNNVDid:CNNVD-201601-370date:2016-01-21T00:00:00
db:NVDid:CVE-2016-1296date:2016-01-20T05:59:02.220