N/A - cisco-sa-20150612-esa

Executive Summary

Summary
Title	Cisco Email Security Appliance Anti-Spam Scanner Bypass Vulnerability

Informations
Name	cisco-sa-20150612-esa	First vendor Publication	2015-06-12
Vendor	Cisco	Last vendor Modification	2015-11-04
Severity (Vendor)	N/A	Revision	2.0

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score	Not Defined	Attack Range	Not Defined
Cvss Impact Score	Not Defined	Attack Complexity	Not Defined
Cvss Expoit Score	Not Defined	Authentication	Not Defined
Calculate full CVSS 2.0 Vectors scores

Detail

A vulnerability in the anti-spam scanner of Cisco AsyncOS for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the anti-spam functionality of the ESA.

The vulnerability is due to improper error handling of a malformed packet in the anti-spam scanner. An attacker could exploit this vulnerability by sending a crafted DNS Sender Policy Framework (SPF) text record. A successful exploit could allow the attacker to bypass the anti-spam scanner and generate a malformed packet alert.

Cisco has released software updates that address this vulnerability. There are no workarounds that mitigate this vulnerability.

This advisory is available at the following link:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150612-esa

BEGIN PGP SIGNATURE Version: GnuPG v1.4.5 (SunOS)

iQIVAwUBVjU+oopI1I6i1Mx3AQLVCg//Q0pNhiu6HbIEHoGVyFAdX0Z1RkbAYrd1 iMReAuei8euJHGVKeWULxT9+uhiobGdkZC0+ZosxvD8vs1cf4o9OqCHZKjfh6OZy haX+mbTez0jnokVEX43UMH9L6Mn9eeJiQY47YUZ1QCBMeRmu5gIfoXSqB4qagItP 9mLmxuetHLDlVLalBYEA3jKDIIs+33fyfCWFOMQI6r5tki1UsGO0F7Xz9JYYdUmo pwq4/gSijrcxbnH8vRmLdwlUgdVk2eje+KE/9+66XN/iW1pqBDKiFjTJvTv7FILr HlPXyftBdgZi5YQTTNXIhEaXfdoaW94TcBlgsr9ZTO15hyZ5fLBarcDpHStu2GPg SKjDRqkftOz36ixXh5LhGhCmVpg2lER1dIrh51Ad0cHPB7AyEChpe1hD6G/TUv5n GWC+BmkX68jCXvVqYpRp3cz/le+2/Q/qKGtvbPDF+kAeq14OyUZW4ruShUzUX8CW iiKIcImPSDuOSs2YeA31JBGsFmf8zZvjYaGQYSMH0AgTiJzAb2C68hz/gOKZoSIp dSC8H0v76xJR75bq1hkB6KpRWusJ4vRLkIuS+G4Dvu8hyukrgwhWeWQVSPjXhu2e qu3xWWDGj7rr3nRjnoQK7MrJ17iNYjDrLe538xP9P7KF6iUwDABHk6RmrIOe2Q7O dDowAhTGRu0= =Sq1c END PGP SIGNATURE _______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com