CVE-2017-13677 Denial of service in Advanced Secure Gateway (ASG)
Remote attackers can crash Symantec ASG and ProxySG management consoles via crafted HTTP requests, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-13677?
CVE-2017-13677 is a high-severity denial of service vulnerability in Symantec Corporation Advanced Secure Gateway (ASG), published on 11 Apr 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Denial-of-service (DoS) vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles. A remote attacker can use crafted HTTP/HTTPS requests to cause denial-of-service through management console application crashes.
Which versions are affected by CVE-2017-13677?
It affects 2 products.
Products include Broadcom Advanced Secure Gateway, Broadcom Symantec Proxysg.
How do I fix CVE-2017-13677?
No fix has been published for CVE-2017-13677 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2017-13677 being exploited?
There is no known exploitation of CVE-2017-13677 in the wild and no public exploit code.
Other vulnerabilities in Symantec Corporation Advanced Secure Gateway (ASG)
- CVE-2023-23952 Command injection in Advanced Secure Gateway, Content Analysis
- CVE-2018-5241 Auth bypass in Advanced Secure Gateway (ASG)
- CVE-2021-46825 Other in Advance Secure Gateway and ProxySG
- CVE-2023-23955 Server-side request forgery in Advanced Secure Gateway, Content Analysis
- CVE-2023-23953 Privilege escalation in Advanced Secure Gateway, Content Analysis
Sources
Also known as GHSA-jv68-f9mv-qwp2.