PT-2017-12405 · Cisco · Cisco Email Security Appliance+1

Publicado 2017-09-21 · Atualizado 2019-10-09 · CVE-2017-12215

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco AsyncOS Software for Cisco Email Security Appliance versions 9.0 through the first fixed release

Description A vulnerability in the email message filtering feature could allow an unauthenticated, remote attacker to cause an affected device to run out of memory and stop scanning and forwarding email messages, resulting in a denial of service (DoS) condition on the device. This occurs when system memory is depleted, causing the filtering process to crash. The vulnerability affects devices configured to apply a message filter or content filter to incoming email attachments, and it is not limited to any specific rules or actions for a message filter or content filter.

Recommendations For Cisco AsyncOS Software for Cisco Email Security Appliance versions 9.0 through the first fixed release, update to the first fixed release to resolve the issue. As a temporary workaround, consider restricting the application of message filters or content filters to incoming email attachments to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-12215

Produtos afetados

Cisco Asyncos

Cisco Email Security Appliance

Referências · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170920-esa · Aviso do Fabricante
• http://securitytracker.com/id/1039414 · Nota
• https://osv.dev/vulnerability/CVE-2017-12215 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-12215 · Nota de Segurança
• http://securityfocus.com/bid/100920 · Nota