Executive Summary
Summary | |
---|---|
Title | Cisco AsyncOS Software Code Execution Vulnerability |
Informations | |||
---|---|---|---|
Name | cisco-sa-20140319-asyncos | First vendor Publication | 2014-03-19 |
Vendor | Cisco | Last vendor Modification | 2014-03-19 |
Severity (Vendor) | N/A | Revision | 1.0 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:S/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 8.5 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Medium |
Cvss Expoit Score | 6.8 | Authentication | Requires single instance |
Calculate full CVSS 2.0 Vectors scores |
Detail
Cisco AsyncOS Software for Email Security Appliance (ESA) and Cisco Content Security Management Appliance (SMA) contain a vulnerability that could allow an authenticated remote attacker to execute arbitrary code with the privileges of the root user. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140319-asyncos BEGIN PGP SIGNATURE Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJTKb4hAAoJEIpI1I6i1Mx35cMP/0ljzKTeBLaUxTB6AKLpxOuF Y3VMZDN/qb5VTUbZ4aiEbN24xkIgtTJnR9kXG4qOQLRX1goJuNJ2nMaX9pCm2k9v hxgIAZaKT1HAyQgculAeAUxXvYAUC1kQKXRpBUWDdsu0vtBo4eN+y8OucjIXxOOH 3d3mXWmxyzMQBtD+HTmwLR+J4qqSePJ0WIrm9m11oj5GN2DRAVKWZ/e7il9X4gwh Ivx6w5MS1l11DhF6l+uXl9J9cRd5QjF0aytUkfnYO/VNr8HWgGObQL/sLkWx6PJ7 s6heSPwDCSfRioHBORbX3b8uncS0A868vE+GH1IEgpLnHeUbDcdvQg1pMHkNEGE4 pxIOueLAifV0/sNQuTYBhvVKz5Hub4Hxy/oRFg+kxrgZmC9acsYDyjDZQjwaImCC q4MXkm6ZqaEdZsjuTrYloD3jk8kb6gD7wPq9mhOas8hisbg0Ahc0TGWtH4Lg/Mh8 UupyGSHMmjXHGgbyI1PUINy64KiCJ3rqSucbxSDHZyZmVKx1BWG1s2asvFoExZSI ThPol4FEJDBiQ+YIpxtDUhF/R+nCPSPb+9+QnsnPcyHjYfCbBjDC1Ym38hrRUgnt PHiaa9THdLd/cCnJmkRV6BzkqZIoTsUJxKfQA9u+KjW8OdlBthet2WaAhTcEqHdU RpiqMIrhjhVpenDg+sze =42JL END PGP SIGNATURE _______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com |
Original Source
Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...) |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-264 | Permissions, Privileges, and Access Controls |
CPE : Common Platform Enumeration
Information Assurance Vulnerability Management (IAVM)
Date | Description |
---|---|
2014-03-27 | IAVM : 2014-A-0044 - Cisco AsyncOS Software Remote Code Execution Vulnerability Severity : Category I - VMSKEY : V0047363 |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2014-03-26 | Name : The remote security appliance is missing a vendor-supplied security patch. File : cisco-sa-20140319-esa.nasl - Type : ACT_GATHER_INFO |
2014-03-26 | Name : The remote security appliance is missing a vendor-supplied patch. File : cisco-sa-20140319-sma.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-03-28 17:19:13 |
|
2014-03-27 13:21:33 |
|
2014-03-21 17:23:10 |
|
2014-03-19 21:19:41 |
|