PT-2020-1826 · Cisco · Cisco Asyncos

Published 2020-03-04 · Updated 2020-03-05 · CVE-2020-3181

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Cisco AsyncOS Software for Cisco Email Security Appliances (ESAs) (affected versions not specified)

Description A vulnerability in the malware detection functionality could allow an unauthenticated remote attacker to exhaust resources on an affected device. The issue is due to insufficient control over system memory allocation. An attacker could exploit this by sending a crafted email through the targeted device, potentially causing email processing delays and allowing malware to be delivered to a user.

Recommendations For Cisco AsyncOS Software for Cisco Email Security Appliances (ESAs), consider implementing additional security measures to restrict the impact of crafted emails until a fix is available. As a temporary workaround, consider enhancing email filtering to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2020-01091

CVE-2020-3181

Affected Products

Cisco Asyncos

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-resource-exhaust-D7RQAhnD · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3181 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01091 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-3181 · Security Note
• https://t.me/cvenotify/1331 · Telegram Post