Lucene search

CiscoCVE-2014-3381

HistoryOct 19, 2014 - 1:55 a.m.

CVE-2014-3381

2014-10-1901:55:13

CWE-264

cisco

web.nvd.nist.gov

cisco

email security appliance

zip inspection

vulnerability

cve-2014-3381

nvd

bug id cscup07934

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

6.8

Confidence

Low

EPSS

0.002

Percentile

58.8%

JSON

The ZIP inspection engine in Cisco AsyncOS 8.5 and earlier on the Cisco Email Security Appliance (ESA) does not properly analyze ZIP archives, which allows remote attackers to bypass malware filtering via a crafted archive, aka Bug ID CSCup07934.

Affected configurations

Nvd

Node

ciscoasyncosRange≤8.5

VendorProductVersionCPE
ciscoasyncos*cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	asyncos	*	cpe:2.3:o:cisco:asyncos::::::::

References

tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3381

tools.cisco.com/security/center/viewAlert.x?alertId=36062

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

6.8

Confidence

Low

EPSS

0.002

Percentile

58.8%

JSON

Related for CVE-2014-3381