Cisco ACE Application Control Engine Module SSL Handling Denial of Service Vulnerability

Bugtraq ID:	42376
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2010-2824
Remote:	Yes
Local:	No
Published:	Aug 11 2010 12:00AM
Updated:	Aug 11 2010 12:00AM
Credit:	Cisco
Vulnerable:	Cisco ACE Module A2(1.3) Cisco ACE Module A2(1.2) Cisco ACE Module A2(1.1) Cisco ACE Module 0 Cisco ACE Application Control Engine Module 3.0(0)A2(2.3) Cisco ACE Application Control Engine Module 3.0(0)A2(2.2.28)
Not Vulnerable:	Cisco ACE Module A2(3.2) Cisco ACE Module A2(3.1) Cisco ACE Module A2(2.3) Cisco ACE Module A2(1.6)

Cisco ACE Application Control Engine Module SSL Handling Denial of Service Vulnerability

Cisco ACE Application Control Engine Module is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to cause an affected device to crash and reload, denying service to legitimate users.

This issue is tracked by Cisco bug ID CSCta20756.

Cisco ACE Application Control Engine Module SSL Handling Denial of Service Vulnerability

Attackers can use readily available tools to exploit this issue.

Cisco ACE Application Control Engine Module SSL Handling Denial of Service Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

Cisco ACE Application Control Engine Module SSL Handling Denial of Service Vulnerability

References:

• Cisco Homepage (Cisco)
  
• Cisco Security Advisory: Multiple Vulnerabilities in the Cisco ACE Application C (Cisco)