====================================================================

                            CERT-Renater

                Note d'Information No. 2016/VULN367
_____________________________________________________________________

DATE                : 27/10/2016

HARDWARE PLATFORM(S): Cisco Email Security Appliance.

OPERATING SYSTEM(S): Cisco AsyncOS Software for Cisco Email Security
                                       Appliances.

=====================================================================
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161026-esa1
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161026-esa2
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161026-esa3
____________________________________________________________________

Cisco Security Advisory: Cisco Email Security Appliance Malformed DGN
File Attachment Denial of Service Vulnerability

Advisory ID: cisco-sa-20161026-esa1

Revision 1.0

For Public Release 2016 October 26 16:00 UTC (GMT)

+---------------------------------------------------------------------

Summary
=======

A vulnerability in the email message filtering feature of Cisco AsyncOS
Software for Cisco Email Security Appliances could allow an
unauthenticated, remote attacker to cause a denial of service (DoS)
condition on an affected device.

The vulnerability exists because the message filtering feature of the
affected software does not properly validate compressed message
attachments that contain malformed Design (DGN) files. An attacker
could exploit this vulnerability by sending a crafted email message,
which has a compressed attachment containing a malformed DGN file,
through an affected device. While the affected software filters the
attachment, memory could be consumed at a high rate and ultimately
exhausted, causing the filtering process to restart and resulting in a
DoS condition. After the filtering process restarts, the software
resumes filtering for the same attachment, causing the filtering
process to exhaust memory and restart again. A successful exploit of
this vulnerability could allow the attacker to cause a repeated DoS
condition.

Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.

This advisory is available at the following link:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161026-esa1

____________________________________________________________________


Cisco Security Advisory: Cisco Email Security Appliance Advanced
Malware Protection Attachment Scanning Denial of Service Vulnerability


Advisory ID: cisco-sa-20161026-esa2

Revision 1.0

For Public Release 2016 October 26 16:00 UTC (GMT)

+---------------------------------------------------------------------

Summary
=======

A vulnerability in the email attachment scanning functionality of the
Advanced Malware Protection (AMP) feature of Cisco AsyncOS Software for
Cisco Email Security Appliances could allow an unauthenticated, remote
attacker to cause an affected device to stop scanning and forwarding
email messages due to a denial of service (DoS) condition.

The vulnerability is due to improper handling of UU-encoded files that
are attached to an email message. An attacker could exploit this
vulnerability by sending a crafted email message with a UU-encoded file
attachment through an affected device. The scanning of the attachment
could cause the mail handling process of the affected software to
restart, resulting in a DoS condition. After the mail handling process
restarts, the software resumes scanning for the same attachment, which
could cause the mail handling process to restart again. A successful
exploit could allow the attacker to cause a repeated DoS condition.

Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.

This advisory is available at the following link:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161026-esa2

____________________________________________________________________


Cisco Security Advisory: Cisco Email Security Appliance Corrupted
Attachment Fields Denial of Service Vulnerability

Advisory ID: cisco-sa-20161026-esa3

Revision 1.0

For Public Release 2016 October 26 16:00 UTC (GMT)

+---------------------------------------------------------------------

Summary
=======

A vulnerability in the email message filtering feature of Cisco AsyncOS
Software for Cisco Email Security Appliances could allow an
unauthenticated, remote attacker to cause an affected device to stop
scanning and forwarding email messages due to a denial of service (DoS)
condition.

The vulnerability is due to improper input validation of email
attachments that have corrupted fields. An attacker could exploit this
vulnerability by sending a crafted email message, which has an
attachment with corrupted fields, through an affected device. When the
affected software filters the attachment, the filtering process could
crash and restart, resulting in a DoS condition. After the filtering
process restarts, the software resumes filtering for the same
attachment, causing the filtering process to crash and restart again. A
successful exploit could allow the attacker to cause a repeated DoS
condition.

Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.

This advisory is available at the following link:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161026-esa3


==========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================