Description (CNA)
A vulnerability in a policy-based Cisco Application Visibility and Control (AVC) implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to evade the antivirus scanner and download a malicious file onto an endpoint. The vulnerability is due to improper handling of a crafted range request header. An attacker could exploit this vulnerability by sending an HTTP request with a crafted range request header through the affected device. A successful exploit could allow the attacker to evade the antivirus scanner and download malware onto the endpoint without detection by Cisco Secure Web Appliance.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Cisco / Cisco Secure Web Appliance | affected 11.8.0-453; affected 12.5.3-002; affected 12.0.3-007; affected 12.0.3-005; affected 14.1.0-032; affected 14.1.0-047; affected 14.1.0-041; affected 12.0.4-002; affected 14.0.2-012; affected 11.8.0-414; affected 12.0.1-268; affected 11.8.1-023; affected 11.8.3-021; affected 11.8.3-018; affected 12.5.1-011; affected 11.8.4-004; affected 12.5.2-007; affected 12.5.2-011; affected 14.5.0-498; affected 12.5.4-005; affected 12.5.4-011; affected 12.0.5-011; affected 14.0.3-014; affected 12.5.5-004; affected 12.5.5-005; affected 12.5.5-008; affected 14.0.4-005; affected 14.5.1-008; affected 14.5.1-016; affected 15.0.0-355; affected 15.0.0-322; affected 12.5.6-008; affected 15.1.0-287; affected 14.5.2-011; affected 15.2.0-116; affected 14.0.5-007; affected 15.2.0-164; affected 14.5.1-510; affected 12.0.2-012; affected 12.0.2-004; affected 14.5.1-607; affected 14.5.3-033; affected 14.5.0-673; affected 14.5.0-537; affected 12.0.1-334; affected 14.0.1-503; affected 14.0.1-053; affected 11.8.0-429; affected 14.0.1-040; affected 14.0.1-014; affected 12.5.1-043 |
CWE
CWE-20
References
ADP enrichment
No English description supplied.
No references supplied.