PT-2015-7150 · Cisco · Cisco Email Security Appliance

Published 2015-09-14 · Updated 2017-01-04 · CVE-2015-6285

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco Email Security Appliance (ESA) versions 7.6.0 through 8.0.0

Description The issue allows remote attackers to cause a denial of service, potentially resulting in memory overwrite or service outage, by including format string specifiers in an HTTP request.

Recommendations For versions 7.6.0 through 8.0.0, consider restricting access to HTTP requests until a fix is available. As a temporary workaround, limiting the use of format string specifiers in HTTP requests may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2015-6285

Affected Products

Cisco Email Security Appliance

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2015-6285 · Security Note
• http://tools.cisco.com/security/center/viewAlert.x?alertId=40844 · Vendor Advisory
• http://securitytracker.com/id/1033531 · Note