nvd-json-data-feeds/CVE-2017/CVE-2017-66xx/CVE-2017-6628.json

{
  "id": "CVE-2017-6628",
  "sourceIdentifier": "ykramarz@cisco.com",
  "published": "2017-05-03T21:59:00.293",
  "lastModified": "2019-10-03T00:03:26.223",
  "vulnStatus": "Modified",
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in SMART-SSL Accelerator functionality for Cisco Wide Area Application Services (WAAS) 6.2.1, 6.2.1a, and 6.2.3a could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition where the WAN optimization could stop functioning while the process restarts. The vulnerability is due to a Secure Sockets Layer/Transport Layer Security (SSL/TLS) alert being incorrectly handled when in a specific SSL/TLS connection state. An attacker could exploit this vulnerability by establishing a SMART-SSL connection through the targeted device. The attacker would then send a crafted stream of SSL/TLS traffic. An exploit could allow the attacker to cause a DoS condition where WAN optimization could stop processing traffic for a short period of time. Cisco Bug IDs: CSCvb71133."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en la funcionalidad de SMART-SSL Accelerator de Cisco Cisco Wide Area Application Services (WAAS) 6.2.1, 6.2.1a y 6.2.3a podr\u00eda permitir a un atacante remoto no autenticado causar una denegaci\u00f3n de servicio (DoS) provocando que la WAN deje de funcionar mientras el proceso se reinicia. La vulnerabilidad se debe a que una alerta de Secure Sockets Layer/Transport Layer Security (SSL/TLS) manejada incorrectamente cuando se encuentra en un estado de conexi\u00f3n SSL / TLS espec\u00edfica. Un atacante podr\u00eda explotar esta vulnerabilidad al establecer una conexi\u00f3n SMART-SSL a trav\u00e9s del dispositivo de destino. El atacante entonces enviar\u00eda una secuencia de tr\u00e1fico SSL / TLS. Un exploit podr\u00eda permitir al atacante causar un DoS en la que la WAN que podr\u00eda detener el procesamiento del tr\u00e1fico durante un corto per\u00edodo de tiempo. ID de errores de Cisco: CSCvb71133."
    }
  ],
  "metrics": {
    "cvssMetricV30": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.0",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 4.0
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
          "accessVector": "NETWORK",
          "accessComplexity": "MEDIUM",
          "authentication": "NONE",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.3
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-755"
        }
      ]
    },
    {
      "source": "ykramarz@cisco.com",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-399"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:cisco:wide_area_application_services:6.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "824B8C4F-EE4C-4654-BA85-B9AB68BF4491"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:cisco:wide_area_application_services:6.2.1a:*:*:*:*:*:*:*",
              "matchCriteriaId": "F29DEA22-F270-44C9-8A6D-F7563A4AE6A5"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:cisco:wide_area_application_services:6.2.3a:*:*:*:*:*:*:*",
              "matchCriteriaId": "DC2637FD-48D3-48F5-819E-91D049C62F2D"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/98294",
      "source": "ykramarz@cisco.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ]
    },
    {
      "url": "http://www.securitytracker.com/id/1038399",
      "source": "ykramarz@cisco.com"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170503-waas",
      "source": "ykramarz@cisco.com",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}