PT-2014-5181 · Microsoft+1 · Sharepoint Server+1

Published 2014-05-29 · Updated 2016-09-07 · CVE-2014-3285

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Cisco Wide Area Application Services (WAAS) versions 5.3(.5a) and earlier

Description The issue is related to the improper parsing of SharePoint responses when SharePoint acceleration is enabled. This allows remote attackers to cause a denial of service by reloading the application-optimization handler via a crafted SharePoint application.

Recommendations For Cisco Wide Area Application Services (WAAS) versions 5.3(.5a) and earlier, consider disabling SharePoint acceleration as a temporary workaround until a patch is available. Restrict access to the SharePoint application to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-3285

Affected Products

Cisco Wide Area Application Services

Sharepoint Server

References · 6

• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3285 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3285 · Security Note
• http://tools.cisco.com/security/center/viewAlert.x?alertId=34395 · Vendor Advisory
• http://secunia.com/advisories/58806 · Note
• http://securitytracker.com/id/1030307 · Note
• http://securityfocus.com/bid/67696 · Note