Details of VAR-201506-0245

ID

VAR-201506-0245

CVE

CVE-2015-4184

TITLE

Cisco Email Security Appliance Device Anti-spam Scanner Vulnerable to bypassing email restrictions

Trust: 0.8

sources: JVNDB: JVNDB-2015-003078

DESCRIPTION

The anti-spam scanner on Cisco Email Security Appliance (ESA) devices 3.3.1-09, 7.5.1-gpl-022, and 8.5.6-074 allows remote attackers to bypass intended e-mail restrictions via a malformed DNS SPF record, aka Bug IDs CSCuu35853 and CSCuu37733. The device provides spam protection, email encryption, and data loss prevention. Successfully exploiting this issue may allow an attacker to bypass certain security restrictions and perform unauthorized actions. This issue is being tracked by Cisco Bug ID's CSCuu35853 and CSCuu37733. The following versions are affected: Cisco ESA Appliance Release 3.3.1-09, Release 7.5.1-gpl-022, Release 8.5.6-074

Trust: 2.52

sources: NVD: CVE-2015-4184 // JVNDB: JVNDB-2015-003078 // CNVD: CNVD-2015-03867 // BID: 75181 // VULHUB: VHN-82145

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2015-03867

AFFECTED PRODUCTS

vendor:	cisco	model:	email security appliance	scope:	eq	version:	8.5.6-074	Trust: 2.5
vendor:	cisco	model:	email security appliance	scope:	eq	version:	7.5.1-gpl-022	Trust: 1.6
vendor:	cisco	model:	email security appliance	scope:	eq	version:	3.331-09	Trust: 1.6
vendor:	cisco	model:	email security appliance	scope:	eq	version:	3.3.1-09	Trust: 0.9
vendor:	cisco	model:	email security appliance 7.6.1-gpl-022	scope:	-	version:	-	Trust: 0.9
vendor:	cisco	model:	e email security the appliance	scope:	eq	version:	3.3.1-09	Trust: 0.8
vendor:	cisco	model:	e email security the appliance	scope:	eq	version:	7.5.1-gpl-022	Trust: 0.8
vendor:	cisco	model:	e email security the appliance	scope:	eq	version:	8.5.6-074	Trust: 0.8
vendor:	cisco	model:	asyncos	scope:	eq	version:	8.0.2	Trust: 0.3
vendor:	cisco	model:	asyncos	scope:	eq	version:	8.0.1	Trust: 0.3
vendor:	cisco	model:	asyncos	scope:	eq	version:	9.6	Trust: 0.3
vendor:	cisco	model:	asyncos	scope:	eq	version:	9.5	Trust: 0.3
vendor:	cisco	model:	asyncos	scope:	eq	version:	9.1	Trust: 0.3
vendor:	cisco	model:	asyncos	scope:	eq	version:	9.0	Trust: 0.3
vendor:	cisco	model:	asyncos	scope:	eq	version:	8.5	Trust: 0.3
vendor:	cisco	model:	asyncos	scope:	eq	version:	8.0	Trust: 0.3
vendor:	cisco	model:	asyncos	scope:	eq	version:	7.5	Trust: 0.3
vendor:	cisco	model:	asyncos	scope:	eq	version:	7.1.5-026	Trust: 0.3
vendor:	cisco	model:	asyncos	scope:	eq	version:	7.1.3-010	Trust: 0.3
vendor:	cisco	model:	asyncos	scope:	ne	version:	9.6.0-042	Trust: 0.3
vendor:	cisco	model:	asyncos	scope:	ne	version:	9.5.0-201	Trust: 0.3
vendor:	cisco	model:	asyncos	scope:	ne	version:	9.1.1-023	Trust: 0.3
vendor:	cisco	model:	asyncos	scope:	ne	version:	9.1.0-032	Trust: 0.3
vendor:	cisco	model:	asyncos	scope:	ne	version:	8.5.7-043	Trust: 0.3
vendor:	cisco	model:	asyncos	scope:	ne	version:	8.0.2-055	Trust: 0.3
vendor:	cisco	model:	asyncos	scope:	ne	version:	7.6.3-027	Trust: 0.3

sources: CNVD: CNVD-2015-03867 // BID: 75181 // JVNDB: JVNDB-2015-003078 // CNNVD: CNNVD-201506-249 // NVD: CVE-2015-4184

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2015-4184
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2015-4184
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2015-03867
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201506-249
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-82145
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2015-4184
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2015-03867
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-82145
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: CNVD: CNVD-2015-03867 // VULHUB: VHN-82145 // JVNDB: JVNDB-2015-003078 // CNNVD: CNNVD-201506-249 // NVD: CVE-2015-4184

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.9

sources: VULHUB: VHN-82145 // JVNDB: JVNDB-2015-003078 // NVD: CVE-2015-4184

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201506-249

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201506-249

CONFIGURATIONS

sources: JVNDB: JVNDB-2015-003078

PATCH

title:

39339

url:

http://tools.cisco.com/security/center/viewAlert.x?alertId=39339

Trust: 0.8

sources: JVNDB: JVNDB-2015-003078

EXTERNAL IDS

db:	NVD	id:	CVE-2015-4184	Trust: 3.4
db:	BID	id:	75181	Trust: 2.0
db:	SECTRACK	id:	1032582	Trust: 1.1
db:	JVNDB	id:	JVNDB-2015-003078	Trust: 0.8
db:	CNNVD	id:	CNNVD-201506-249	Trust: 0.7
db:	CNVD	id:	CNVD-2015-03867	Trust: 0.6
db:	VULHUB	id:	VHN-82145	Trust: 0.1

sources: CNVD: CNVD-2015-03867 // VULHUB: VHN-82145 // BID: 75181 // JVNDB: JVNDB-2015-003078 // CNNVD: CNNVD-201506-249 // NVD: CVE-2015-4184

REFERENCES

url:	http://tools.cisco.com/security/center/viewalert.x?alertid=39339	Trust: 2.6
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-4184	Trust: 1.4
url:	http://www.securityfocus.com/bid/75181	Trust: 1.1
url:	http://www.securitytracker.com/id/1032582	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-4184	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3
url:	http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20150612-esa	Trust: 0.3

sources: CNVD: CNVD-2015-03867 // VULHUB: VHN-82145 // BID: 75181 // JVNDB: JVNDB-2015-003078 // CNNVD: CNNVD-201506-249 // NVD: CVE-2015-4184

CREDITS

Cisco

Trust: 0.3

sources: BID: 75181

SOURCES

db:	CNVD	id:	CNVD-2015-03867
db:	VULHUB	id:	VHN-82145
db:	BID	id:	75181
db:	JVNDB	id:	JVNDB-2015-003078
db:	CNNVD	id:	CNNVD-201506-249
db:	NVD	id:	CVE-2015-4184

LAST UPDATE DATE

2024-11-23T22:49:22.523000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2015-03867	date:	2015-06-19T00:00:00
db:	VULHUB	id:	VHN-82145	date:	2017-01-04T00:00:00
db:	BID	id:	75181	date:	2015-12-08T22:05:00
db:	JVNDB	id:	JVNDB-2015-003078	date:	2015-06-16T00:00:00
db:	CNNVD	id:	CNNVD-201506-249	date:	2015-06-18T00:00:00
db:	NVD	id:	CVE-2015-4184	date:	2024-11-21T02:30:35.583

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2015-03867	date:	2015-06-19T00:00:00
db:	VULHUB	id:	VHN-82145	date:	2015-06-13T00:00:00
db:	BID	id:	75181	date:	2015-06-12T00:00:00
db:	JVNDB	id:	JVNDB-2015-003078	date:	2015-06-16T00:00:00
db:	CNNVD	id:	CNNVD-201506-249	date:	2015-06-15T00:00:00
db:	NVD	id:	CVE-2015-4184	date:	2015-06-13T10:59:00.067