Lucene search

CiscoCVE-2016-6458

HistoryNov 19, 2016 - 3:03 a.m.

CVE-2016-6458

2016-11-1903:03:01

CWE-20

cisco

web.nvd.nist.gov

cisco

security

appliances

content filtering

vulnerability

cve-2016-6458

cisco asyncos software

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

7.6

Confidence

High

EPSS

0.003

Percentile

68.3%

JSON

A vulnerability in the content filtering functionality of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthenticated, remote attacker to bypass content filters configured on an affected device. Email that should have been filtered could instead be forwarded by the device. This vulnerability affects all releases prior to the first fixed release of Cisco AsyncOS Software for Cisco Email Security Appliances, both virtual and hardware appliances, if the software is configured to use a content filter for email attachments that are protected or encrypted. More Information: CSCva52546. Known Affected Releases: 10.0.0-125 9.7.1-066.

Affected configurations

Nvd

Node

ciscoemail_security_appliance_firmwareMatch9.7.1-066

ciscoemail_security_appliance_firmwareMatch9.7.2-046

ciscoemail_security_appliance_firmwareMatch9.7.2-047

ciscoemail_security_appliance_firmwareMatch9.7.2-054

ciscoemail_security_appliance_firmwareMatch9.9.6-026

ciscoemail_security_appliance_firmwareMatch9.9_base

ciscoemail_security_appliance_firmwareMatch10.0.0-124

ciscoemail_security_appliance_firmwareMatch10.0.0-125

VendorProductVersionCPE
ciscoemail_security_appliance_firmware9.7.1-066cpe:2.3:o:cisco:email_security_appliance_firmware:9.7.1-066:*:*:*:*:*:*:*
ciscoemail_security_appliance_firmware9.7.2-046cpe:2.3:o:cisco:email_security_appliance_firmware:9.7.2-046:*:*:*:*:*:*:*
ciscoemail_security_appliance_firmware9.7.2-047cpe:2.3:o:cisco:email_security_appliance_firmware:9.7.2-047:*:*:*:*:*:*:*
ciscoemail_security_appliance_firmware9.7.2-054cpe:2.3:o:cisco:email_security_appliance_firmware:9.7.2-054:*:*:*:*:*:*:*
ciscoemail_security_appliance_firmware9.9.6-026cpe:2.3:o:cisco:email_security_appliance_firmware:9.9.6-026:*:*:*:*:*:*:*
ciscoemail_security_appliance_firmware9.9_basecpe:2.3:o:cisco:email_security_appliance_firmware:9.9_base:*:*:*:*:*:*:*
ciscoemail_security_appliance_firmware10.0.0-124cpe:2.3:o:cisco:email_security_appliance_firmware:10.0.0-124:*:*:*:*:*:*:*
ciscoemail_security_appliance_firmware10.0.0-125cpe:2.3:o:cisco:email_security_appliance_firmware:10.0.0-125:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	email_security_appliance_firmware	9.7.1-066	cpe:2.3:o:cisco:email_security_appliance_firmware:9.7.1-066:::::::*
cisco	email_security_appliance_firmware	9.7.2-046	cpe:2.3:o:cisco:email_security_appliance_firmware:9.7.2-046:::::::*
cisco	email_security_appliance_firmware	9.7.2-047	cpe:2.3:o:cisco:email_security_appliance_firmware:9.7.2-047:::::::*
cisco	email_security_appliance_firmware	9.7.2-054	cpe:2.3:o:cisco:email_security_appliance_firmware:9.7.2-054:::::::*
cisco	email_security_appliance_firmware	9.9.6-026	cpe:2.3:o:cisco:email_security_appliance_firmware:9.9.6-026:::::::*
cisco	email_security_appliance_firmware	9.9_base	cpe:2.3:o:cisco:email_security_appliance_firmware:9.9_base:::::::*
cisco	email_security_appliance_firmware	10.0.0-124	cpe:2.3:o:cisco:email_security_appliance_firmware:10.0.0-124:::::::*
cisco	email_security_appliance_firmware	10.0.0-125	cpe:2.3:o:cisco:email_security_appliance_firmware:10.0.0-125:::::::*

CNA Affected

[
  {
    "product": "Cisco AsyncOS 10.0.0-125 and 9.7.1-066",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco AsyncOS 10.0.0-125 and 9.7.1-066"
      }
    ]
  }
]

References

www.securityfocus.com/bid/94074

www.securitytracker.com/id/1037182

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161102-esa

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

7.6

Confidence

High

EPSS

0.003

Percentile

68.3%

JSON

Related for CVE-2016-6458