PT-2017-16118 · Cisco · Cisco Asyncos

Publicado 2017-02-03 · Atualizado 2017-07-25 · CVE-2017-3818

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco AsyncOS Software for Cisco Email Security Appliances versions prior to 9.8.0-092

Description A issue in the Multipurpose Internet Mail Extensions (MIME) scanner could allow an unauthenticated, remote attacker to bypass configured user filters on the device. This is possible when the software is configured to apply a message filter or content filter to incoming email attachments.

Recommendations For versions prior to 9.8.0-092, update to version 9.8.0-092 or later to resolve the issue. As a temporary workaround, consider disabling the MIME scanner until a patch is available. Restrict access to email attachments to minimize the risk of exploitation. Avoid using message filters or content filters on incoming email attachments until the issue is resolved.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-3818

Produtos afetados

Cisco Asyncos

Referências · 5

• http://securityfocus.com/bid/95939 · Nota
• http://securitytracker.com/id/1037773 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-3818 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-3818 · Aviso do Fabricante
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170201-esa1 · Aviso do Fabricante