Executive Summary

Title Cisco Email Security Appliance Corrupted Attachment Fields Denial of Service Vulnerability
Name cisco-sa-20161026-esa3 First vendor Publication 2016-10-26
Vendor Cisco Last vendor Modification 2016-10-26
Severity (Vendor) N/A Revision 1.0

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:C)
Cvss Base Score 7.8 Attack Range Network
Cvss Impact Score 6.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores


A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthenticated, remote attacker to cause an affected device to stop scanning and forwarding email messages due to a denial of service (DoS) condition.

The vulnerability is due to improper input validation of email attachments that have corrupted fields. An attacker could exploit this vulnerability by sending a crafted email message, which has an attachment with corrupted fields, through an affected device. When the affected software filters the attachment, the filtering process could crash and restart, resulting in a DoS condition. After the filtering process restarts, the software resumes filtering for the same attachment, causing the filtering process to crash and restart again. A successful exploit could allow the attacker to cause a repeated DoS condition.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161026-esa3

BEGIN PGP SIGNATURE Version: GnuPG v1.4.5 (SunOS)

iQIVAwUBWAedua89gD3EAJB5AQIOlBAA2+nYWHtIoo6idYeCYFiXYxlpVwtDWIjU 7wEleNwd564UN+IY6jTCY+3eW0zPnA0vrk10iwQm7xVy3WTVfqTU/m1TS3fOgSzI X+stWrOXeU3tWehVfZkBKF5UbSEe8CNU7vAzminsy5dq5hfTHTx/oSXWuB4wV2Be HMO8IxJRFPV7DO2xz3FkqEf360vTUIoRiP7CGmwZ6+CEp4Lm/LDE3/oVuaHoaj/Q XrikOqRa4gabGszQ1mSUH+cgqgFRb/MLQaL8AcKd8VYnj8nRIpqAN7W1FvsoXvcZ O0GreEL9EoBICWXsCuEa/lBGxqPHn9PwRReQu+0RnDzsTXK3Js0vcO77lLmydFb6 6/7ykkJDK7XlldYBBNzc2CvgBVa8/LEsB5xPWV1UplaAxB/dFU4S9JI5Y3AioKJ +xUD9P68OYTjOguLGvAcCPkLOqKGuchPPYu19QEnMeP5SDA84ooYP+l24OQa5HV6L hQbxgdXi6NMs50r2SpfpbSrk7pTYW/wUT++uKLl619r1G8EIJJqTdl3PtFvoAoxz dyLw/hPfyTGHE2ZV0CIlzgBykFUkNp8RhtO1UDPT9Z4Dqod44oLiGroqaul4V77/ zcHvOT4yLWDhwiKm3Dv5my5NvV4+Tc24bBwVj9S8Y/7lxGM/BQJF97AfN7UrH9mA kLEPJFLPx0k= =yYBs END PGP SIGNATURE _______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com

Original Source

Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...)

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-20 Improper Input Validation

CPE : Common Platform Enumeration

Application 56

Snort® IPS/IDS

Date Description
2016-10-27 Cisco ESA lzw attachment parsing denial of service attempt
RuleID : 40552 - Revision : 1 - Type : SERVER-OTHER

Alert History

If you want to see full details history, please login or register.
Date Informations
2016-10-29 00:25:21
  • Multiple Updates
2016-10-26 21:21:13
  • First insertion