Executive Summary

Summary
Title Cisco AsyncOS Software Code Execution Vulnerability
Informations
Name cisco-sa-20140319-asyncos First vendor Publication 2014-03-19
Vendor Cisco Last vendor Modification 2014-03-19
Severity (Vendor) N/A Revision 1.0

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:S/C:C/I:C/A:C)
Cvss Base Score 8.5 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 6.8 Authentication Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

Cisco AsyncOS Software for Email Security Appliance (ESA) and Cisco Content Security Management Appliance (SMA) contain a vulnerability that could allow an authenticated remote attacker to execute arbitrary code with the privileges of the root user.

Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available.

This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140319-asyncos BEGIN PGP SIGNATURE Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org

iQIcBAEBAgAGBQJTKb4hAAoJEIpI1I6i1Mx35cMP/0ljzKTeBLaUxTB6AKLpxOuF Y3VMZDN/qb5VTUbZ4aiEbN24xkIgtTJnR9kXG4qOQLRX1goJuNJ2nMaX9pCm2k9v hxgIAZaKT1HAyQgculAeAUxXvYAUC1kQKXRpBUWDdsu0vtBo4eN+y8OucjIXxOOH 3d3mXWmxyzMQBtD+HTmwLR+J4qqSePJ0WIrm9m11oj5GN2DRAVKWZ/e7il9X4gwh Ivx6w5MS1l11DhF6l+uXl9J9cRd5QjF0aytUkfnYO/VNr8HWgGObQL/sLkWx6PJ7 s6heSPwDCSfRioHBORbX3b8uncS0A868vE+GH1IEgpLnHeUbDcdvQg1pMHkNEGE4 pxIOueLAifV0/sNQuTYBhvVKz5Hub4Hxy/oRFg+kxrgZmC9acsYDyjDZQjwaImCC q4MXkm6ZqaEdZsjuTrYloD3jk8kb6gD7wPq9mhOas8hisbg0Ahc0TGWtH4Lg/Mh8 UupyGSHMmjXHGgbyI1PUINy64KiCJ3rqSucbxSDHZyZmVKx1BWG1s2asvFoExZSI ThPol4FEJDBiQ+YIpxtDUhF/R+nCPSPb+9+QnsnPcyHjYfCbBjDC1Ym38hrRUgnt PHiaa9THdLd/cCnJmkRV6BzkqZIoTsUJxKfQA9u+KjW8OdlBthet2WaAhTcEqHdU RpiqMIrhjhVpenDg+sze =42JL END PGP SIGNATURE _______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com

Original Source

Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...)

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-264 Permissions, Privileges, and Access Controls

CPE : Common Platform Enumeration

TypeDescriptionCount
Hardware 1
Os 1
Os 27

Information Assurance Vulnerability Management (IAVM)

Date Description
2014-03-27 IAVM : 2014-A-0044 - Cisco AsyncOS Software Remote Code Execution Vulnerability
Severity : Category I - VMSKEY : V0047363

Nessus® Vulnerability Scanner

Date Description
2014-03-26 Name : The remote security appliance is missing a vendor-supplied security patch.
File : cisco-sa-20140319-esa.nasl - Type : ACT_GATHER_INFO
2014-03-26 Name : The remote security appliance is missing a vendor-supplied patch.
File : cisco-sa-20140319-sma.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
3
Date Informations
2014-03-28 17:19:13
  • Multiple Updates
2014-03-27 13:21:33
  • Multiple Updates
2014-03-21 17:23:10
  • Multiple Updates
2014-03-19 21:19:41
  • First insertion