CVE-2016-1383: High severity cisco web security appliance vulnerability

Published May 25, 2016

Updated

Memory leak in Cisco AsyncOS through 8.8 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (memory consumption) via an unspecified HTTP status code, aka Bug ID CSCur28305.

Affected Software

28 affected components

Cisco Web Security Appliance

Cisco Web Security Appliance \(wsa\)=5.6.0-623

Cisco Web Security Appliance \(wsa\)=6.0.0-000

Cisco Web Security Appliance \(wsa\)=7.1.0

Cisco Web Security Appliance \(wsa\)=7.1.1

Cisco Web Security Appliance \(wsa\)=7.1.2

Cisco Web Security Appliance \(wsa\)=7.1.3

Cisco Web Security Appliance \(wsa\)=7.1.4

Cisco Web Security Appliance \(wsa\)=7.5.0-000

Cisco Web Security Appliance \(wsa\)=7.5.0-825

Cisco Web Security Appliance \(wsa\)=7.5.1-000

Cisco Web Security Appliance \(wsa\)=7.5.2-000

Cisco Web Security Appliance \(wsa\)=7.7.0-000

Cisco Web Security Appliance \(wsa\)=7.7.1-000

Cisco Web Security Appliance \(wsa\)=8.0.0-000

Cisco Web Security Appliance \(wsa\)=8.0.5

Cisco Web Security Appliance \(wsa\)=8.0.6

Cisco Web Security Appliance \(wsa\)=8.0.6-078

Cisco Web Security Appliance \(wsa\)=8.0.6-119

Cisco Web Security Appliance \(wsa\)=8.0.7

Cisco Web Security Appliance \(wsa\)=8.0.7-142

Cisco Web Security Appliance \(wsa\)=8.0.8-mr-113

Cisco Web Security Appliance \(wsa\)=8.5.0-497

Cisco Web Security Appliance \(wsa\)=8.5.0.000

Cisco Web Security Appliance \(wsa\)=8.5.1-021

Cisco Web Security Appliance \(wsa\)=8.5.2-024

Cisco Web Security Appliance \(wsa\)=8.5.2-027

Cisco Web Security Appliance \(wsa\)=8.5.3-055

Event History

May 25, 2016

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-1383?

CVE-2016-1383 is classified as a denial of service vulnerability due to memory consumption issues.

How do I fix CVE-2016-1383?

To mitigate CVE-2016-1383, users should upgrade to a fixed version of Cisco AsyncOS that addresses this memory leak.

Which Cisco devices are affected by CVE-2016-1383?

CVE-2016-1383 affects Cisco Web Security Appliance devices running vulnerable versions of AsyncOS up to 8.8.

How can CVE-2016-1383 be exploited?

CVE-2016-1383 can be exploited remotely by sending an unspecified HTTP status code, leading to a denial of service.

Is there a workaround for CVE-2016-1383?

Currently, there are no specific workarounds for CVE-2016-1383; updating to the latest version is recommended.