Attackers Can Crash Cisco Email Security Appliances by Sending Malicious Emails
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-20653 | A vulnerability in the DNS-based Authentication of Named Entities (DANE) email verification component of Cisco AsyncOS Software for Cisco Email Security Applian A vulnerability in the DNS-based Authentication of Named Entities (DANE) email verification component of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient error handling in DNS name resolution by the affected software. An attacker could exploit this vulnerability by sending specially formatted email messages that are processed by an affected device. A successful exploit could allow the attacker to cause the device to become unreachable from management interfaces or to process additional email messages for a period of time until the device recovers, resulting in a DoS condition. Continued attacks could cause the device to become completely unavailable, resulting in a persistent DoS condition. NVD description · AI analysis pending | 7.5 | 2% |
| — | ||
| CVE-2022-20659 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an unauthen A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. NVD description · AI analysis pending | 6.1 | 1% |
| — | ||
| CVE-2022-20750 | A vulnerability in the checkpoint manager implementation of Cisco Redundancy Configuration Manager (RCM) for Cisco StarOS Software could allow an unauthenticate A vulnerability in the checkpoint manager implementation of Cisco Redundancy Configuration Manager (RCM) for Cisco StarOS Software could allow an unauthenticated, remote attacker to cause the checkpoint manager process to restart upon receipt of malformed TCP data. This vulnerability is due to improper input validation of an ingress TCP packet. An attacker could exploit this vulnerability by sending crafted TCP data to the affected application. A successful exploit could allow the attacker to cause a denial of service (DoS) condition due to the checkpoint manager process restarting. NVD description · AI analysis pending | 7.5 | 1% |
| — |
Full article358 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananFeb 18, 2022
Cisco has released security updates to contain three vulnerabilities affecting its products, including one high-severity flaw in its Email Security Appliance (ESA) that could result in a denial-of-service (DoS) condition on an affected device.
The weakness, assigned the identifier CVE-2022-20653 (CVSS score: 7.5), stems from a case of insufficient error handling in DNS name resolution that could be abused by an unauthenticated, remote attacker to send a specially crafted email message and cause a DoS.
"A successful exploit could allow the attacker to cause the device to become unreachable from management interfaces or to process additional email messages for a period of time until the device recovers, resulting in a DoS condition," the company said in an advisory. "Continued attacks could cause the device to become completely unavailable, resulting in a persistent DoS condition."
The flaw impacts Cisco ESA devices running Cisco AsyncOS Software running versions 14.0, 13.5, 13.0, 12.5 and earlier and have the "DANE feature enabled and with the downstream mail servers configured to send bounce messages." DANE is short for DNS-based Authentication of Named Entities, which is used for outbound mail validation.
Cisco credited researchers from ICT service provider Rijksoverheid Dienst ICT Uitvoering (DICTU) for reporting the vulnerability, while pointing out that it's not found any evidence of malicious exploitation.
Separately, the networking equipment maker also addressed two other flaws in its Prime Infrastructure and Evolved Programmable Network Manager and Redundancy Configuration Manager that could enable an adversary to execute arbitrary code and cause a DoS condition –
- CVE-2022-20659 (CVSS score: 6.1) – Cisco Prime Infrastructure and Evolved Programmable Network Manager cross-site scripting (XSS) vulnerability
- CVE-2022-20750 (CVSS score: 5.3) – Cisco Redundancy Configuration Manager for Cisco StarOS Software TCP denial-of-service (DoS) vulnerability
The fixes also come weeks after Cisco published patches for multiple critical security vulnerabilities impacting its RV Series routers, some of which earned the highest possible CVSS severity score ratings of 10, that could be weaponized to elevate privileges and execute arbitrary code on affected systems.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2022/02/attackers-can-crash-cisco-email.html