Sign-up

ID

VAR-201603-0036


CVE

CVE-2016-1288


TITLE

Cisco Web Security Runs on the appliance device AsyncOS of HTTPS Service operation interruption in proxy function (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2016-001686

DESCRIPTION

The HTTPS Proxy feature in Cisco AsyncOS before 8.5.3-051 and 9.x before 9.0.0-485 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (service outage) by leveraging certain intranet connectivity and sending a malformed HTTPS request, aka Bug ID CSCuu24840. Cisco AsyncOS on Web Security Appliance (WSA) is a set of operating systems run on Web Security Appliance (WSA) by Cisco. A security vulnerability exists in the Web proxy framework of Cisco WSA running Cisco AsyncOS versions prior to 8.5.3-051 and versions prior to 9.0.0-485. The vulnerability is due to the program not properly handling HTTPS packets. A remote attacker could exploit this vulnerability to cause a denial of service (packet loss)

Trust: 1.71

sources: NVD: CVE-2016-1288 // JVNDB: JVNDB-2016-001686 // VULHUB: VHN-90107

AFFECTED PRODUCTS

vendor:ciscomodel:web security appliancescope:eqversion:9.0.0-193

Trust: 1.6

vendor:ciscomodel:web security appliancescope:eqversion:8.5.0-497

Trust: 1.6

vendor:ciscomodel:web security the appliancescope:eqversion:9.0.0-485

Trust: 0.8

vendor:ciscomodel:web security the appliancescope:ltversion:9.x

Trust: 0.8

sources: JVNDB: JVNDB-2016-001686 // CNNVD: CNNVD-201603-010 // NVD: CVE-2016-1288

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-1288
value: MEDIUM

Trust: 1.0

NVD: CVE-2016-1288
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201603-010
value: MEDIUM

Trust: 0.6

VULHUB: VHN-90107
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2016-1288
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-90107
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-1288
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
exploitabilityScore: 3.9
impactScore: 1.4
version: 3.0

Trust: 1.0

sources: VULHUB: VHN-90107 // JVNDB: JVNDB-2016-001686 // CNNVD: CNNVD-201603-010 // NVD: CVE-2016-1288

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

sources: VULHUB: VHN-90107 // JVNDB: JVNDB-2016-001686 // NVD: CVE-2016-1288

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201603-010

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201603-010

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-001686

PATCH
title:cisco-sa-20160302-wsaurl:http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-wsa
Trust: 0.8
title:Cisco Web Security Appliance Web Agent framework denial of service vulnerability fixesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=60375
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2016-001686 // 
            
            
            
            CNNVD: CNNVD-201603-010

EXTERNAL IDS
db:NVDid:CVE-2016-1288
Trust: 2.5
db:SECTRACKid:1035163
Trust: 1.1
db:JVNDBid:JVNDB-2016-001686
Trust: 0.8
db:CNNVDid:CNNVD-201603-010
Trust: 0.7
db:BIDid:83936
Trust: 0.1
db:VULHUBid:VHN-90107
Trust: 0.1
sources:
            
            
            VULHUB: VHN-90107 // 
            
            
            
            JVNDB: JVNDB-2016-001686 // 
            
            
            
            CNNVD: CNNVD-201603-010 // 
            
            
            
            NVD: CVE-2016-1288

REFERENCES
url:http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20160302-wsa
Trust: 1.7
url:http://www.securitytracker.com/id/1035163
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-1288
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-1288
Trust: 0.8
sources:
            
            
            VULHUB: VHN-90107 // 
            
            
            
            JVNDB: JVNDB-2016-001686 // 
            
            
            
            CNNVD: CNNVD-201603-010 // 
            
            
            
            NVD: CVE-2016-1288

SOURCES
db:VULHUBid:VHN-90107
db:JVNDBid:JVNDB-2016-001686
db:CNNVDid:CNNVD-201603-010
db:NVDid:CVE-2016-1288

LAST UPDATE DATE
2024-11-23T22:27:02.813000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-90107date:2018-10-30T00:00:00
db:JVNDBid:JVNDB-2016-001686date:2016-03-14T00:00:00
db:CNNVDid:CNNVD-201603-010date:2016-03-03T00:00:00
db:NVDid:CVE-2016-1288date:2024-11-21T02:46:07.367

SOURCES RELEASE DATE
db:VULHUBid:VHN-90107date:2016-03-03T00:00:00
db:JVNDBid:JVNDB-2016-001686date:2016-03-14T00:00:00
db:CNNVDid:CNNVD-201603-010date:2016-03-03T00:00:00
db:NVDid:CVE-2016-1288date:2016-03-03T22:59:12.490