PT-2016-7708 · Cisco · Cisco Web Security Appliances

Publicado 2016-12-14 · Atualizado 2016-12-22 · CVE-2016-9212

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cisco Web Security Appliances versions 9.0.1-162 through 9.1.1-074

Description A vulnerability in the Decrypt for End-User Notification configuration parameter could allow an unauthenticated, remote attacker to connect to a secure website over Secure Sockets Layer (SSL) or Transport Layer Security (TLS), even if the WSA is configured to block connections to the website. This issue affects devices with HTTPS decryption options enabled and configured to block certain websites.

Recommendations For versions 9.0.1-162 through 9.1.1-074, consider disabling the HTTPS decryption options as a temporary workaround until a patch is available. Restrict access to the Decrypt for End-User Notification configuration parameter to minimize the risk of exploitation. Avoid using the Decrypt for End-User Notification feature in the affected configuration until the issue is resolved.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2016-9212

Produtos afetados

Cisco Web Security Appliances

Referências · 5

• http://securityfocus.com/bid/94774 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-wsa1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-9212 · Nota de Segurança
• http://securitytracker.com/id/1037410 · Nota
• https://osv.dev/vulnerability/CVE-2016-9212 · Aviso do Fabricante