PT-2016-6935 · Cisco · Cisco Asyncos

Publicado 2016-11-19 · Atualizado 2016-11-28 · CVE-2016-6463

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco AsyncOS Software for Cisco Email Security Appliances versions prior to 10.0.0-203 Cisco AsyncOS Software for Cisco Email Security Appliances versions prior to 9.7.2-131

Description A vulnerability in the email filtering functionality could allow an unauthenticated, remote attacker to bypass Advanced Malware Protection (AMP) filters configured for an affected device, if the AMP feature is configured to scan incoming email attachments.

Recommendations For versions 10.0.0-082, 9.7.0-125, and 9.7.1-066, update to a fixed release, such as 10.0.0-203 or 9.7.2-131, to resolve the issue. As a temporary workaround, consider disabling the AMP feature for scanning incoming email attachments until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2016-6463

Produtos afetados

Cisco Asyncos

Referências · 4

• http://securityfocus.com/bid/94363 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-6463 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161116-esa2 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-6463 · Aviso do Fabricante