|
[Japanese]
|
JVNDB-2017-000099
|
SSL Visibility Appliance may generate illegal RST packets
|
|
SSL Visibility Appliance provided by Blue Coat Systems, Inc. is used as a transparent proxy for encrypted traffic management.
It is reported that the appliance generates RST packets with incorrect sequence numbers when it receives HTTPS requests from certain web browsers. When the web server behind the appliance fails to treat these incorrect RST packets, it keeps the encrypted session indefinitely.
This behavior may be used to cause a denial-of-service (DoS) condition on the server side.
According to the developer, this issue does not affect the appliance.
NTT-ME CORPORATION Cyber Security Center reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
|
|
CVSS V3 Severity:
Base Metrics 7.2 (High) [IPA Score]
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: Low
CVSS V2 Severity:
Base Metrics 5.0 (Medium) [IPA Score]
- Access Vector: Network
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: None
- Integrity Impact: Partial
- Availability Impact: None
|
|
|
Blue Coat Systems, Inc.
- SSL Visibility Appliance 3.8.4FC, 3.9, 3.10, and 3.11 prior to 3.11.3.1
|
SSL Visibility Appliance 4.0 is not affected.
|
|
A denial-of-service (DoS) attack to a server may be conducted by an unauthenticated remote attacker.
|
|
[Update the Appliance]
Update to the latest version according to the information provided by the developer.
|
|
Blue Coat Systems, Inc.
|
|
- No Mapping(CWE-Other) [IPA Evaluation]
|
|
- CVE-2016-10259
|
|
- JVN : JVN#91438377
- National Vulnerability Database (NVD) : CVE-2016-10259
|
|
- [2017/05/24]
Web page was published
[2017/05/31]
Vendor Information : Link was modified
|
