CVE-2015-0654 : Race condition in the TLS implementation in MainApp in the management interface in Cisco Intrusion Prevention System (IP

Race condition in the TLS implementation in MainApp in the management interface in Cisco Intrusion Prevention System (IPS) Software before 7.3(3)E4 allows remote attackers to cause a denial of service (process hang) by establishing many HTTPS sessions, aka Bug ID CSCuq40652.

Published 2015-03-13 01:59:33

Updated 2015-09-11 15:50:16

Source Cisco Systems, Inc.

View at NVD, CVE.org

Vulnerability category: Denial of service

Exploit prediction scoring system (EPSS) score for CVE-2015-0654

EPSS FAQ

0.19%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 55 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-0654

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.1	HIGH	AV:N/AC:M/Au:N/C:N/I:N/A:C	8.6	6.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Complete

CWE ids for CVE-2015-0654

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-0654

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150311-ips

Cisco Intrusion Prevention System MainApp Secure Socket Layer Denial of Service Vulnerability
Vendor Advisory
http://www.securitytracker.com/id/1031908

Cisco Intrusion Prevention System MainApp SSL Processing Flaw Lets Remote Users Deny Service - SecurityTracker

Products affected by CVE-2015-0654

Cisco » Intrusion Prevention System » Version: 7.2(1)e4
cpe:2.3:a:cisco:intrusion_prevention_system:7.2\(1\)e4:*:*:*:*:*:*:*
Matching versions
Cisco » Intrusion Prevention System » Version: 7.3(2)e4
cpe:2.3:a:cisco:intrusion_prevention_system:7.3\(2\)e4:*:*:*:*:*:*:*
Matching versions
Cisco » Intrusion Prevention System » Version: 7.2(2)e4
cpe:2.3:a:cisco:intrusion_prevention_system:7.2\(2\)e4:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2015-0654

Exploit prediction scoring system (EPSS) score for CVE-2015-0654

CVSS scores for CVE-2015-0654

CWE ids for CVE-2015-0654

References for CVE-2015-0654

Products affected by CVE-2015-0654