Cisco Web Security Appliance Decryption Policy Bypass Vulnerability

A vulnerability in the Decryption Policy Default Action functionality of the Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to bypass a configured drop policy and allow traffic onto the network that should have been denied. The vulnerability is due to the incorrect handling of SSL-encrypted traffic when Decrypt for End-User Notification is disabled in the configuration. An attacker could exploit this vulnerability by sending a SSL connection through the affected device. A successful exploit could allow the attacker to bypass a configured drop policy to block specific SSL connections. Releases 10.1.x and 10.5.x are affected.

N/A

未加控制的资源消耗(资源穷尽)

Cisco Web Security Appliance 资源管理错误漏洞

Cisco Web Security Appliance（WSA）是美国思科（Cisco）公司的一套Web安全设备。该设备提供基于SaaS的访问控制、实时网络报告和追踪、制定安全策略等功能。 Cisco WSA 10.1.x版本和10.5.x版本中的Decryption Policy Default Action功能存在安全漏洞，该漏洞源于程序没有正确地处理由SSL所加密的流量。远程攻击者可利用该漏洞阻止进行SSL连接。

N/A

N/A