Vulnerability Note VU#330275

Cisco Content Service Switch reboots when HTTPS POST request is sent to web management interface

Overview

The Cisco Content Service Switch contains a denial-of-service vulnerability that allows remote attackers to reboot affected devices.

I. Description

The Cisco Content Service Switch (CSS) products include support for the session and application layers. This additional functionality allows a CSS device to make packet switching decisions based on packet contents (such as HTML tags) rather than relying solely upon packet header information.

The CSS 11000 series switch contains a vulnerability that causes the device to reboot when an HTTPS POST request is sent to its web management interface. Please note that this vulnerability can be exploited by unauthenticated attackers.

II. Impact

This vulnerability allows arbitrary remote attackers to reboot affected devices, creating a denial-of-service condition.

III. Solution

Apply a patch from Cisco

Cisco has prepared a patch to address this vulnerability. For more information on affected products and obtaining patches, please see

http://www.cisco.com/warp/public/707/css-http-post-pub.shtml

Prevent access to the web management interface

Cisco customers who are unable to patch affected devices can limit the exploitation of this vulnerability by preventing access to the web management interface. This can be accomplished via the use of a firewall or by disabling the web management interface from an alternate management interface.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Cisco	Vulnerable	23-May-2002

References

http://www.cisco.com/warp/public/707/css-http-post-pub.shtml
http://www.securityfocus.com/bid/4747

Credit

This document was written by Jeffrey P. Lanza based on information provided by Cisco Systems.

Other Information

Date Public:	2002-05-15
Date First Published:	2002-05-22
Date Last Updated:	2002-05-30
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Metric:	16.87
Document Revision:	18

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader