OSVDB ID: 35333

Title: Cisco PIX / ASA Crafted Clientless SSL Connection Race Condition DoS

Info

Disclosure
May 02, 2007

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Unknown

Description

 PIX/ASA contains a flaw that may allow a remote denial of service. The issue is triggered when by an unspecified flaw in the SSL VPN HTTP server related to processing non-standard SSL sessions, and will result in loss of availability for the platform.

Classification

 Location: Remote / Network Access
Attack Type: Denial of Service
Impact: Loss of Availability
Exploit: Exploit Unknown
Disclosure: OSVDB Verified
OSVDB: Security Software

Solution

 Upgrade to version 7.1(2)49 or 7.2(2)19 or higher, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Cisco Systems, Inc.

PIX

 7.2(1)
7.2(2)2
7.1(2)46
7.1(2)42
7.1(2)28
7.1(2)24
7.1(2)20
7.1(2)16
7.1(2)12
7.1(2)7
7.1(2)4
7.1(2)
7.2(2)14
7.2(2)10
7.2(2)18

ASA

 7.2(1)
7.2(2)2
7.1(2)46
7.1(2)42
7.1(2)28
7.1(2)24
7.1(2)20
7.1(2)16
7.1(2)12
7.1(2)7
7.1(2)4
7.1(2)
7.2(2)14
7.2(2)10
7.2(2)18

References

Credit

Unknown or Incomplete


Direct URL: http://osvdb.org/36218