Cisco Security Agent Remote Port Scan Denial of Service Vulnerability

Bugtraq ID:	20737
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Oct 25 2006 12:00AM
Updated:	Oct 25 2006 09:38PM
Credit:	The vendor disclosed this issue.
Vulnerable:	Cisco Unified Presence Server 1.0(2) Cisco Unified Presence Server 1.0 Cisco Unified CallManager 5.0(4) Cisco Unified CallManager 5.0(3a) Cisco Unified CallManager 5.0(3) Cisco Unified CallManager 5.0(2) Cisco Unified CallManager 5.0(1) Cisco Security Agent 4.5.1 .639 Cisco Security Agent 4.5.1 Cisco Security Agent 4.5 Cisco Security Agent 5.0
Not Vulnerable:	Cisco Security Agent 5.0 .193 Cisco Security Agent 4.5.1 .657 Cisco Security Agent 5.1

Cisco Security Agent Remote Port Scan Denial of Service Vulnerability

Cisco Security Agent (CSA) for Linux is vulnerable to a remote denial-of-service vulnerability because the application fails to properly handle unexpected network traffic.

Successfully exploiting this issue allows remote attackers to cause the affected software to enter into an unresponsive state, denying further service to legitimate users.

This issue does not affect CSA for Windows or Solaris.

Cisco Security Agent Remote Port Scan Denial of Service Vulnerability

Attackers use readily available port-scanning utilities to exploit this issue.

Cisco Security Agent Remote Port Scan Denial of Service Vulnerability

Solution:
Cisco has released an advisory and fixes to address this issue. Please see the referenced advisory for more information on obtaining and applying fixes.

Cisco Security Agent Remote Port Scan Denial of Service Vulnerability

References:

• Cicso Security Advisory: Cisco Security Agent for Linux Port Scan Denial of Serv (Cisco)
  
• Cisco Security Agent Home Page (Cisco)
  
• Cisco Security Advisory: Cisco Security Agent for Linux Port Scan Denial of Serv (Cisco Systems Product Security Incident Response Team )