PT-2017-12442 · Cisco · Cisco Waas+1

Publicado 2017-10-05 · Atualizado 2019-10-09 · CVE-2017-12267

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Cisco Wide Area Application Services (WAAS) (affected versions not specified) Cisco Virtual Wide Area Application Services (vWAAS) (affected versions not specified)

Description A vulnerability in the Independent Computing Architecture (ICA) accelerator feature could allow an unauthenticated, remote attacker to cause an ICA application optimization-related process to restart, resulting in a partial denial of service (DoS) condition. This is due to improperly aborting a connection when an unexpected protocol packet is received. An attacker could exploit this by sending crafted ICA traffic through the targeted device, potentially causing a DoS condition due to a process unexpectedly restarting, which could lead to the device dropping ICA traffic while the process is restarting.

Recommendations For Cisco Wide Area Application Services (WAAS), consider temporarily disabling the ICA accelerator feature until a patch is available. For Cisco Virtual Wide Area Application Services (vWAAS), consider temporarily disabling the ICA accelerator feature until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2017-12267

Produtos afetados

Cisco Waas

Cisco Vwaas

Referências · 4

• https://osv.dev/vulnerability/CVE-2017-12267 · Aviso do Fabricante
• http://securityfocus.com/bid/101176 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171004-waas1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-12267 · Nota de Segurança