Executive Summary
Summary | |
---|---|
Title | Cisco Email Security Appliance Malformed DGN File Attachment Denial of Service Vulnerability |
Informations | |||
---|---|---|---|
Name | cisco-sa-20161026-esa1 | First vendor Publication | 2016-10-26 |
Vendor | Cisco | Last vendor Modification | 2016-10-26 |
Severity (Vendor) | N/A | Revision | 1.0 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:C) | |||
---|---|---|---|
Cvss Base Score | 7.8 | Attack Range | Network |
Cvss Impact Score | 6.9 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability exists because the message filtering feature of the affected software does not properly validate compressed message attachments that contain malformed Design (DGN) files. An attacker could exploit this vulnerability by sending a crafted email message, which has a compressed attachment containing a malformed DGN file, through an affected device. While the affected software filters the attachment, memory could be consumed at a high rate and ultimately exhausted, causing the filtering process to restart and resulting in a DoS condition. After the filtering process restarts, the software resumes filtering for the same attachment, causing the filtering process to exhaust memory and restart again. A successful exploit of this vulnerability could allow the attacker to cause a repeated DoS condition. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161026-esa1 BEGIN PGP SIGNATURE Version: GnuPG v1.4.5 (SunOS) iQIVAwUBWAedja89gD3EAJB5AQLHvhAAuBm7hZs40pBvZZwyhtcSiEf1BhfTthrr AcUK3IegobD3q0HkaT5HEHgFBZ9VaqlISG6dEQLM5aK94bC0pCUtbT7UzCYqqAVO j2jx7cWfUF5AXFKI8UKlACX95RuQYYbBhIE0vxmur3MqlYm30jriUvNKEu1YJ2UA 3ZUiioNh2+Fb+tT0rWHg6DGU7MGdzEglw+uxC3YuLp2s8xpvV7mnQXhGlsDz5Ycu sH6qcL16AGIza4yjLuJPOjqOL0P9C5mpMLOxeZi0CR5G7csXHCWY7j5UvwQfHPhj TKV73WhE0cUWXAQOcwM4xFycaN2BWDBRp13ovhy3nn/vDVtzFRjgMTLr3PKhueOW Pt0WpWbhSnGu/RbAKXSSyCnyzqYluF8XNx7c22ztUhLSRuKikB91eNoOuB6MPnbE upD99gYGUtlPwwrduFpqUdAtrOcVbLjHHUD9Z+fMCbYQAqIIWIOiHwuWN+asYS2g /m4ZjZYfR3AqjQRhup14LZzwgT0PawmIpZ+HTRME7/BmDXuwZPbdYf3PKaZ0yiZ4 RaXD8AAyWC9m9ZZZ12G4ImtFSfpy7HLPUZhd6wWrFYnt4gt+xSM+71u6eJIlQnut kriQ5+rx5BasvK9aqfwYDIqRc/uy4mn+1S/QzKwZ80DlW7R5VgG6k66XyK8gWcH5 XLt5g0sfqAE= =watm END PGP SIGNATURE _______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com |
Original Source
Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...) |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-20 | Improper Input Validation |
CPE : Common Platform Enumeration
Alert History
Date | Informations |
---|---|
2016-10-29 00:25:21 |
|
2016-10-26 21:21:10 |
|