SB2018081608 - Denial of service in Cisco AsyncOS for Cisco Web Security Appliances
Published: August 16, 2018
Security Bulletin ID
SB2018081608
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Resource exhaustion (CVE-ID: CVE-2018-0410)
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliances due to improper management of memory resources for TCP connections. A remote attacker can establish a high number of TCP connections to the data interface of an affected device via IPv4 or IPv6, exhaust system memory and cause the system to stop processing new connections.
Remediation
Install update from vendor's website.