CVE-2017-12267: Buffer Overflow
First published: Thu Oct 05 2017(Updated: )
A vulnerability in the Independent Computing Architecture (ICA) accelerator feature for the Cisco Wide Area Application Services (WAAS) could allow an unauthenticated, remote attacker to cause an ICA application optimization-related process to restart, resulting in a partial denial of service (DoS) condition. The vulnerability is due to improperly aborting a connection when an unexpected protocol packet is received. An attacker could exploit this vulnerability by sending a crafted ICA traffic through the targeted device. A successful exploit could allow the attacker to cause a DoS condition that is due to a process unexpectedly restarting. The Cisco WAAS could drop ICA traffic while the process is restarting. This vulnerability affects Cisco Wide Area Application Services (WAAS) and Cisco Virtual Wide Area Application Services (vWAAS). Cisco Bug IDs: CSCve74457.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Virtual Wide Area Application Services | =6.2\(3b\) | |
| Cisco Wide Area Application Services | =6.2\(3b\) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-12267?
CVE-2017-12267 has a severity rating that categorizes it as a partial denial of service vulnerability.
How do I fix CVE-2017-12267?
To remediate CVE-2017-12267, update Cisco Wide Area Application Services and Cisco Virtual Wide Area Application Services to the latest patched versions.
Who is affected by CVE-2017-12267?
CVE-2017-12267 affects users of Cisco Wide Area Application Services version 6.2(3b) and Cisco Virtual Wide Area Application Services version 6.2(3b).
What type of attack does CVE-2017-12267 enable?
CVE-2017-12267 allows unauthenticated, remote attackers to cause a denial of service by restarting an ICA application optimization-related process.
Is CVE-2017-12267 being actively exploited?
At this time, there are no reports indicating that CVE-2017-12267 is actively exploited in the wild.
- collector/nvd-index
- agent/weakness
- agent/severity
- agent/author
- agent/tags
- agent/references
- agent/event
- agent/type
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- vendor/cisco
- canonical/cisco virtual wide area application services
- version/cisco virtual wide area application services/6.2\(3b\)
- canonical/cisco wide area application services
- version/cisco wide area application services/6.2\(3b\)