Denial of service in Oracle Enterprise Communications Broker and Palo Alto PAN-OS - CVE-2014-9708

Vulnerability identifier: #VU945

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2014-9708

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote unauthenticated user to cause DoS conditions on the target system.
The weakness exists due to null pointer dereference. By sending a specially crafted HTTP Range Header value, attackers can trigger the web service crash.
Successful exploitation of the vulnerability leads to denial of service on the vulerable system.

Oracle Enterprise Communications Broker
Palo Alto PAN-OS

Update to version 5.1.13 or later.

• http://securityadvisories.paloaltonetworks.com/Home/Detail/60
• http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

• Denial of service in Palo Alto PAN-OS