CVE-2016-6399 Denial of service in n/a
Remote attackers can cause a denial of service via crafted SSL or TLS packets, requiring administrators to apply vendor patches.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-6399?
CVE-2016-6399 is a high-severity denial of service vulnerability in n/a, published on 12 Sep 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Cisco ACE30 Application Control Engine Module through A5 3.3 and ACE 4700 Application Control Engine appliances through A5 3.3 allow remote attackers to cause a denial of service (device reload) via crafted (1) SSL or (2) TLS packets, aka Bug ID CSCvb16317.
Weakness: CWE-20
Which versions are affected by CVE-2016-6399?
It affects 9 products.
Products include Cisco Ace 4700 Series Application Control Engine Appliance, Cisco Ace 4700 Series Application Control Engine Appliance A1, Cisco Ace 4700 Series Application Control Engine Appliance A3, Cisco Ace 4700 Series Application Control Engine Appliance A4, Cisco Ace 4700 Series Application Control Engine Appliance A5, Cisco Ace Application Control Engine Module A1 and 3 more.
How do I fix CVE-2016-6399?
No fix has been published for CVE-2016-6399 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2016-6399 being exploited?
There is no known exploitation of CVE-2016-6399 in the wild and no public exploit code.
Sources
Also known as GHSA-hgp8-6r4g-qxxh.