Vulnerability Description
Cisco PIX/ASA 7.1.x before 7.1(2) and 7.0.x before 7.0(5), PIX 6.3.x before 6.3.5(112), and FWSM 2.3.x before 2.3(4) and 3.x before 3.1(7), when used with Websense/N2H2, allows remote attackers to bypass HTTP access restrictions by splitting the GET method of an HTTP request into multiple packets, which prevents the request from being sent to Websense for inspection, aka bugs CSCsc67612, CSCsc68472, and CSCsd81734.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Adaptive Security Appliance Software | 7.0 |
| Cisco | Pix Firewall | 6.2.2.111 |
| Cisco | Firewall Services Module | 2.3 |
| Cisco | Pix Firewall Software | 2.7 |
References
- http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045899.html
- http://secunia.com/advisories/20044
- http://securitytracker.com/id?1016039
- http://securitytracker.com/id?1016040
- http://www.cisco.com/en/US/products/sw/netmgtsw/ps2032/tsd_products_security_res
- http://www.osvdb.org/25453
- http://www.securityfocus.com/archive/1/433270/100/0/threaded
- http://www.securityfocus.com/bid/17883Exploit
- http://www.vsecurity.com/bulletins/advisories/2006/cisco-websense-bypass.txtPatchVendor Advisory
- http://www.vupen.com/english/advisories/2006/1738
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26308
- http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045899.html
- http://secunia.com/advisories/20044
- http://securitytracker.com/id?1016039
- http://securitytracker.com/id?1016040
FAQ
What is CVE-2006-0515?
CVE-2006-0515 is a vulnerability with a CVSS score of 7.5 (HIGH). Cisco PIX/ASA 7.1.x before 7.1(2) and 7.0.x before 7.0(5), PIX 6.3.x before 6.3.5(112), and FWSM 2.3.x before 2.3(4) and 3.x before 3.1(7), when used with Websense/N2H2, allows remote attackers to byp...
How severe is CVE-2006-0515?
CVE-2006-0515 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2006-0515?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco Adaptive Security Appliance Software, Cisco Pix Firewall, Cisco Firewall Services Module, Cisco Pix Firewall Software.