Cisco Email Security Appliance Multiple DoS Vulnerabilities (cisco-sa-20190109-esa-dos / cisco-sa-20190109-esa-url-dos)
High Nessus Plugin ID 121248
SynopsisThe remote device is missing a vendor-supplied security patch.
DescriptionAccording to its self-reported version, the Cisco Email Security
Appliance (ESA) is affected by the following vulnerabilities:
- A denial of service (DoS) vulnerability exists in
Secure/Multipurpose Internet Mail Extensions (S/MIME)
Decryption and Verification and S/MIME Public Key
Harvesting features due to improper input validation of
S/MIME-signed emails. An unauthenticated, remote
attacker can exploit this issue, via malicious
S/MIME-signed email, to cause the process to stop
- A denial of service (DoS) vulnerability exists in email
message filtering feature due to improper filtering of
email messages that contain references to whitelisted
URLs. An unauthenticated, remote attacker can exploit
this issue, via malicious email message that contains a
large number of whitelisted URLs, to cause the system to
stop responding (CVE-2018-15460).
SolutionUpgrade to the relevant fixed version referenced in Cisco Security Advisory
cisco-sa-20190109-esa-dos and cisco-sa-20190109-esa-url-dos.