----------------------------------------------------------------------

Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.

The Full Featured Secunia Network Software Inspector (NSI) is now
available:
http://secunia.com/network_software_inspector/

The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.

----------------------------------------------------------------------

TITLE:
Cisco Wide Area Application Services Edge Services SYN Flood Denial
of Service

SECUNIA ADVISORY ID:
SA26122

VERIFY ADVISORY:
http://secunia.com/advisories/26122/

CRITICAL:
Less critical

IMPACT:
DoS

WHERE:
>From local network

SOFTWARE:
Cisco Wide Area Application Services (WAAS)
http://secunia.com/product/12541/

DESCRIPTION:
A vulnerability has been reported in Cisco Wide Area Application
Services (WAAS), which can be exploited by malicious people to cause
a DoS (Denial of Service).

The vulnerability is caused due to an error in Edge Services, which
uses CIFS optimisation, when handling packets sent to ports 139/TCP
and 445/TCP. This can be exploited to cause a device running WAAS to
stop processing all traffic by sending a TCP SYN flood to port
139/TCP or 445/TCP.

Successful exploitation requires that WAAS is configured for Edge
Services.

The vulnerability is reported in WAE appliances and the NM-WAE-502
network modules running WAAS versions 4.0.7 or 4.0.9.

SOLUTION:
Update to version 4.0.11.
http://www.cisco.com/pcgi-bin/tablebuild.pl/waas40?psrtdcat20e2

PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.

ORIGINAL ADVISORY:
Cisco:
http://www.cisco.com/warp/public/707/cisco-sa-20070718-waas.shtml

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------