Denial of service in Cisco Web Security Appliance - CVE-2016-6360
Published: October 27, 2016 / Updated: April 5, 2018
Vulnerability identifier: #VU1100
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-6360
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote unauthenticated user to cause partial DoS conditions on the target system.
The weakness is due to input validation flaw. By sending a specially crafted Kava Archive (JAR) file, a remote attacker can trigger the Advanced Malware Protection (AMP) service to restart after scanning that file.
Successful exploitation of the vulnerability results in denial of service.
The weakness is due to input validation flaw. By sending a specially crafted Kava Archive (JAR) file, a remote attacker can trigger the Advanced Malware Protection (AMP) service to restart after scanning that file.
Successful exploitation of the vulnerability results in denial of service.
Affected software
Cisco Web Security Appliance
How to mitigate CVE-2016-6360
Update to version 10.0.0-233.