Details of VAR-201910-0343

ID

VAR-201910-0343

CVE

CVE-2019-12706

TITLE

Cisco Email Security Appliance of AsyncOS Software input validation vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-010442

DESCRIPTION

A vulnerability in the Sender Policy Framework (SPF) functionality of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the configured user filters on an affected device. The vulnerability exists because the affected software insufficiently validates certain incoming SPF messages. An attacker could exploit this vulnerability by sending a custom SPF packet to an affected device. A successful exploit could allow the attacker to bypass the configured header filters, which could allow malicious content to pass through the device

Trust: 1.71

sources: NVD: CVE-2019-12706 // JVNDB: JVNDB-2019-010442 // VULHUB: VHN-144479

AFFECTED PRODUCTS

vendor:	cisco	model:	email security appliance	scope:	lt	version:	13.5.0	Trust: 1.0
vendor:	cisco	model:	e email security appliance	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	email security appliance	scope:	eq	version:	7.3.0	Trust: 0.6
vendor:	cisco	model:	email security appliance	scope:	eq	version:	7.1.3	Trust: 0.6
vendor:	cisco	model:	email security appliance	scope:	eq	version:	3.3.1-09	Trust: 0.6
vendor:	cisco	model:	email security appliance	scope:	eq	version:	7.1.1	Trust: 0.6
vendor:	cisco	model:	email security appliance	scope:	eq	version:	7.3	Trust: 0.6
vendor:	cisco	model:	email security appliance	scope:	eq	version:	7.1.2	Trust: 0.6
vendor:	cisco	model:	email security appliance	scope:	eq	version:	7.1.0	Trust: 0.6
vendor:	cisco	model:	email security appliance	scope:	eq	version:	7.1.4	Trust: 0.6
vendor:	cisco	model:	email security appliance	scope:	eq	version:	-	Trust: 0.6
vendor:	cisco	model:	email security appliance	scope:	eq	version:	7.1.5	Trust: 0.6

sources: JVNDB: JVNDB-2019-010442 // CNNVD: CNNVD-201910-079 // NVD: CVE-2019-12706

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-12706
value:	HIGH
Trust: 1.0
ykramarz@cisco.com:	CVE-2019-12706
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2019-12706
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201910-079
value:	HIGH
Trust: 0.6
VULHUB:	VHN-144479
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2019-12706
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-144479
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2019-12706
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0
ykramarz@cisco.com:	CVE-2019-12706
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	2.5
version:	3.0
Trust: 1.0
NVD:	CVE-2019-12706
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-144479 // JVNDB: JVNDB-2019-010442 // CNNVD: CNNVD-201910-079 // NVD: CVE-2019-12706 // NVD: CVE-2019-12706

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.9

sources: VULHUB: VHN-144479 // JVNDB: JVNDB-2019-010442 // NVD: CVE-2019-12706

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201910-079

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201910-079

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-010442

PATCH

title:	cisco-sa-20191002-esa-bypass	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-esa-bypass	Trust: 0.8
title:	Cisco Email Security Appliance Enter the fix for the verification error vulnerability	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=98815	Trust: 0.6

sources: JVNDB: JVNDB-2019-010442 // CNNVD: CNNVD-201910-079

EXTERNAL IDS

db:	NVD	id:	CVE-2019-12706	Trust: 2.5
db:	JVNDB	id:	JVNDB-2019-010442	Trust: 0.8
db:	AUSCERT	id:	ESB-2020.0623	Trust: 0.6
db:	AUSCERT	id:	ESB-2019.3707	Trust: 0.6
db:	CNNVD	id:	CNNVD-201910-079	Trust: 0.6
db:	VULHUB	id:	VHN-144479	Trust: 0.1

sources: VULHUB: VHN-144479 // JVNDB: JVNDB-2019-010442 // CNNVD: CNNVD-201910-079 // NVD: CVE-2019-12706

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20191002-esa-bypass	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2019-12706	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-12706	Trust: 0.8
url:	https://www.auscert.org.au/bulletins/esb-2019.3707/	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2020.0623/	Trust: 0.6
url:	https://vigilance.fr/vulnerability/cisco-email-security-appliance-privilege-escalation-via-filter-bypass-30520	Trust: 0.6

sources: VULHUB: VHN-144479 // JVNDB: JVNDB-2019-010442 // CNNVD: CNNVD-201910-079 // NVD: CVE-2019-12706

CREDITS

Fabian Henneke of the University of Bonn .

Trust: 0.6

sources: CNNVD: CNNVD-201910-079

SOURCES

db:	VULHUB	id:	VHN-144479
db:	JVNDB	id:	JVNDB-2019-010442
db:	CNNVD	id:	CNNVD-201910-079
db:	NVD	id:	CVE-2019-12706

LAST UPDATE DATE

2024-11-23T21:36:41.791000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-144479	date:	2019-10-10T00:00:00
db:	JVNDB	id:	JVNDB-2019-010442	date:	2019-10-15T00:00:00
db:	CNNVD	id:	CNNVD-201910-079	date:	2020-02-24T00:00:00
db:	NVD	id:	CVE-2019-12706	date:	2024-11-21T04:23:24.300

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-144479	date:	2019-10-02T00:00:00
db:	JVNDB	id:	JVNDB-2019-010442	date:	2019-10-15T00:00:00
db:	CNNVD	id:	CNNVD-201910-079	date:	2019-10-02T00:00:00
db:	NVD	id:	CVE-2019-12706	date:	2019-10-02T19:15:13.967