You are here
Home > Preporuke > Sigurnosni nedostatak Anti-Spam komponente proizvoda Email Security Appliance

Sigurnosni nedostatak Anti-Spam komponente proizvoda Email Security Appliance

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

Cisco Email Security Appliance Anti-Spam Scanner Bypass Vulnerability

Advisory ID: cisco-sa-20150612-esa

Revision 2.0

For Public Release 2015 November 4 16:00 UTC (GMT)

+———————————————————————

Summary
=======

A vulnerability in the anti-spam scanner of Cisco AsyncOS for Cisco
Email Security Appliance (ESA) could allow an unauthenticated, remote
attacker to bypass the anti-spam functionality of the ESA.

The vulnerability is due to improper error handling of a malformed
packet in the anti-spam scanner. An attacker could exploit this
vulnerability by sending a crafted DNS Sender Policy Framework (SPF)
text record. A successful exploit could allow the attacker to bypass
the anti-spam scanner and generate a malformed packet alert.

Cisco has released software updates that address this vulnerability.
There are no workarounds that mitigate this vulnerability.

This advisory is available at the following link:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150612-esa

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.5 (SunOS)

iQIVAwUBVjU+oopI1I6i1Mx3AQLVCg//Q0pNhiu6HbIEHoGVyFAdX0Z1RkbAYrd1
iMReAuei8euJHGVKeWULxT9+uhiobGdkZC0+ZosxvD8vs1cf4o9OqCHZKjfh6OZy
haX+mbTez0jnokVEX43UMH9L6Mn9eeJiQY47YUZ1QCBMeRmu5gIfoXSqB4qagItP
9mLmxuetHLDlVLalBYEA3jKDIIs+33fyfCWFOMQI6r5tki1UsGO0F7Xz9JYYdUmo
pwq4/gSijrcxbnH8vRmLdwlUgdVk2eje+KE/9+66XN/iW1pqBDKiFjTJvTv7FILr
HlPXyftBdgZi5YQTTNXIhEaXfdoaW94TcBlgsr9ZTO15hyZ5fLBarcDpHStu2GPg
SKjDRqkftOz36ixXh5LhGhCmVpg2lER1dIrh51Ad0cHPB7AyEChpe1hD6G/TUv5n
GWC+BmkX68jCXvVqYpRp3cz/le+2/Q/qKGtvbPDF+kAeq14OyUZW4ruShUzUX8CW
iiKIcImPSDuOSs2YeA31JBGsFmf8zZvjYaGQYSMH0AgTiJzAb2C68hz/gOKZoSIp
dSC8H0v76xJR75bq1hkB6KpRWusJ4vRLkIuS+G4Dvu8hyukrgwhWeWQVSPjXhu2e
qu3xWWDGj7rr3nRjnoQK7MrJ17iNYjDrLe538xP9P7KF6iUwDABHk6RmrIOe2Q7O
dDowAhTGRu0=
=Sq1c
—–END PGP SIGNATURE—–
_______________________________________________
cust-security-announce mailing list
cust-security-announce@cisco.com
To unsubscribe, send the command “unsubscribe” in the subject of your message to cust-security-announce-leave@cisco.com

Top
More in Preporuke
Sigurnosni nedostatak komponente Email Scanner proizvoda Cisco Email Security Appliance

Otkriven je sigurnosni nedostatak u komponenti Email Scanner Ciscovog proizvoda Cisco Email Security Appliance. Otkriveni nedostatak potencijalnim napadačima omogućuje izvođenje...

Close