CVE-2013-5959 - CVSS v2 base score: 8.5 (AV:N/AC:M/Au:N/C:N/I:P/A:C)

This issue highlights memory exhaustion and/or pipeline overload due to the high number of HTTP RW pipeline pre-fetch requests from some web sites. This can effectively be deemed a denial-of-service (DoS) attack and can be triggered remotely by distributing spam email or similar mechanisms where the target user clicks through to a site that can trigger the memory regulation issue. Due to the nature of the issue, this is assessed as high severity.

Sites with high number of recursively embedded HREFs in the HTML can quickly cause one of the following scenarios:

1. Memory regulation and/or crash/reboot when unlimited retrieval workers are allowed on the ProxySG and a large number of retrieval workers are created.
2. Crash/reboot when retrieval workers are constrained on the proxy and a large number of retrieval workers are created.
3. Random HTTP response delays in less severe cases.

The workaround is to disable pipelining on this traffic. To disable pipelining, select Configuration > Proxy Settings > HTTP Proxy > Acceleration in the Management Console. Under Acceleration Settings, clear the checkboxes beside the following options:

• Pipeline embedded objects client request
• Pipeline redirects for client request
• Pipeline embedded objects in prefetch request
• Pipeline redirects for prefetch request

Click Apply to save your changes.

The associated CLI commands to disable pipelining are as follows:

http no pipeline client requests 
http no pipeline client redirects
http no pipeline prefetch requests
http no pipeline prefetch redirects

Refer to the SGOS Administration Guide for your version of SGOS for details.