Lucene search

K
symantecSymantec Security ResponseSMNTC-111516
HistoryOct 07, 2019 - 12:00 a.m.

Bouncy Castle Java Cryptography APIs CVE-2019-17359 Denial of Service Vulnerability

2019-10-0700:00:00
Symantec Security Response
www.symantec.com
29

Description

Bouncy Castle Java Cryptography APIs are prone to a denial-of-service vulnerability. Successful exploitation of this issue will cause excessive resource consumption, resulting in a denial-of-service condition. Bouncy Castle Java Cryptography API 1.63 is vulnerable.

Technologies Affected

  • Bouncycastle Legion-Of-The-Bouncy-Castle-Java-Crytography-Api 1.63
  • Cisco Unified Intelligence Center 12.5(1)
  • NetApp Active IQ Unified Manager for Linux 7.3
  • NetApp Active IQ Unified Manager for VMware vSphere 9.5
  • NetApp Active IQ Unified Manager for Windows 7.3
  • NetApp OnCommand Workflow Automation
  • NetApp Service Level Manager
  • Oracle Hospitality Guest Access 4.2.0
  • Oracle Weblogic Server 12.2.1.3.0
  • Oracle Weblogic Server 12.2.1.4.0

Recommendations

Block external access at the network boundary, unless external parties require service.
If possible, block access to the server at the network perimeter. Allow only trusted computers and networks to have access to the resources.

Deploy network intrusion detection systems to monitor network traffic for malicious activity.
Deploy NIDS to monitor the network for suspicious requests. This may help detect attacks that try to exploit These and similar vulnerabilities. Audit all applicable logs regularly.

Run all software as a nonprivileged user with minimal access rights.
To reduce the impact of a successful exploit, run the hosting webserver in a chrooted or jailed environment with the minimal amount of privileges required for functionality.

Updates are available. Please see the references or vendor advisory for more information.

Related for SMNTC-111516