Vulnerability in Cisco Intrusion Prevention System

CVE-2015-0654

Race condition in the TLS implementation in MainApp in the management interface in Cisco Intrusion Prevention System (IPS) Software before 7.3(3)E4 allows remote attackers to cause a denial of service (process hang) by establishing many HTTPS sessions, aka Bug ID CSCuq40652.

Vulnerability class: Race Condition

EPSS: 0.013 (66.7th percentile) — read the EPSS interpretation.

Affected products

Cisco Intrusion_prevention_system — versions 7.2\(1\)e4, 7.2\(2\)e4, 7.3\(2\)e4
N/a — versions n/a

Weakness classification (CWE)

CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
psirt@cisco.com (vdb-entry, x_refsource_SECTRACK)