CVE-2013-1199: cisco adaptive_security_appliance_clientless_ssl_vpn Race Condition

Vulnerability summary

CVE-2013-1199 is a medium (CVSS 4.9) Race Condition vulnerability in cisco adaptive_security_appliance_clientless_ssl_vpn. EPSS estimates a 0.90% chance of exploitation in the next 30 days, higher than 59.1% of scored vulnerabilities.

Timeline

1. 18-04-2013
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

Race condition in the CIFS implementation in the rewriter module in the Clientless SSL VPN component on Cisco Adaptive Security Appliances (ASA) devices allows remote authenticated users to cause a denial of service (device reload) by accessing resources within multiple sessions, aka Bug ID CSCub58996.

• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.