PT-2018-8780 · Cisco · Cisco Web Security Appliance

Published 2018-06-07 · Updated 2019-10-09 · CVE-2018-0353

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Web Security Appliance (WSA) versions 10.5.1 through 11.0.0

Description A vulnerability in traffic-monitoring functions could allow an unauthenticated, remote attacker to bypass security protections by circumventing Layer 4 Traffic Monitor (L4TM) functionality. This is due to a change in the underlying operating system software responsible for monitoring affected traffic. An attacker could exploit this by sending crafted IP packets to an affected device, potentially allowing them to pass traffic through the device that the WSA was configured to deny. This issue affects both IPv4 and IPv6 traffic.

Recommendations For Cisco Web Security Appliance (WSA) versions 10.5.1 through 11.0.0, consider disabling the Layer 4 Traffic Monitor (L4TM) functionality as a temporary workaround until a patch is available. Restrict access to the device to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-254

Related Identifiers

CVE-2018-0353

Affected Products

Cisco Web Security Appliance

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-0353 · Security Note
• https://osv.dev/vulnerability/CVE-2018-0353 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-wsa · Vendor Advisory
• http://securityfocus.com/bid/104417 · Note
• http://securitytracker.com/id/1041081 · Note