PT-2017-12408 · Cisco · Cisco Asyncos

Publicado 2017-09-07 · Atualizado 2019-10-09 · CVE-2017-12218

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco AsyncOS Software for Cisco Email Security Appliances (ESAs) (affected versions not specified)

Description A vulnerability in the malware detection functionality of Cisco AsyncOS Software for Cisco Email Security Appliances (ESAs) could allow an unauthenticated, remote attacker to cause an email attachment containing malware to be delivered to the end user. This is due to the failure of Advanced Malware Protection (AMP) to scan certain EML attachments that could contain malware. An attacker could exploit this by sending an email with a crafted EML attachment through the targeted device, potentially bypassing configured email message and content filtering, and allowing malware to be delivered to the end user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-12218

Produtos afetados

Cisco Asyncos

Referências · 4

• http://securitytracker.com/id/1039288 · Nota
• http://securityfocus.com/bid/100681 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-12218 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-esa · Aviso do Fabricante