Cisco Adaptive Security Appliance WebVPN Embedded Web Server Denial of Service Vulnerability

2015-02-12T15:06:07
ID CISCO-SA-20150212-CVE-2015-0619
Type cisco
Reporter Cisco
Modified 2015-02-12T15:05:59

Description

A vulnerability in the WebVPN feature of Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to force the ASA to stop accepting new SSL connections.

The vulnerability is due to a memory leak in the WebVPN embedded web server. An attacker could exploit this vulnerability by sending a large number of crafted HTTP requests to the ASA.

Cisco has confirmed the vulnerability in a security notice and released software updates.

To exploit this vulnerability, an attacker may need access to trusted, internal networks to send large amounts of crafted HTTP requests to a targeted device. This access requirement may reduce the likelihood of a successful exploit.