==================================================================== CERT-Renater Note d'Information No. 2020/VULN083 _____________________________________________________________________ DATE : 19/02/2020 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Cisco AsyncOS running Cisco ESA versions prior to 11.0.3-251, 12.5.0-059, Cisco SMA versions prior to 11.0.1-161, 12.5.0-633. ===================================================================== https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200219-esa-sma-dos https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200219-esa-dos _____________________________________________________________________ Cisco Email Security Appliance and Cisco Content Security Management Appliance Denial of Service Vulnerability High Advisory ID: cisco-sa-20200219-esa-sma-dos First Published: 2020 February 19 16:00 GMT Version 1.0: Final Workarounds: No workarounds available Cisco Bug IDs: CSCvo89182 CSCvo89192 CVSS Score: Base 7.5 CVE-2019-1983 CWE-20 Summary A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) and Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to cause repeated crashes in some internal processes that are running on the affected devices, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient input validation of email attachments. An attacker could exploit this vulnerability by sending an email message with a crafted attachment through an affected device. A successful exploit could allow the attacker to cause specific processes to crash repeatedly, resulting in the complete unavailability of both the Cisco Advanced Malware Protection (AMP) and message tracking features and in severe performance degradation while processing email. After the affected processes restart, the software resumes filtering for the same attachment, causing the affected processes to crash and restart again. A successful exploit could also allow the attacker to cause a repeated DoS condition. Manual intervention may be required to recover from this situation. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200219-esa-sma-dos Affected Products Vulnerable Products This vulnerability affects Cisco ESA and Cisco SMA virtual and hardware appliances if they are running a vulnerable release of Cisco AsyncOS Software that is configured to use either Cisco AMP or message tracking. For information about which releases are vulnerable, see the Fixed Software section of this advisory. Products Confirmed Not Vulnerable Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability. Cisco has confirmed that this vulnerability does not affect Cisco Web Security Appliance (WSA). Workarounds There are no workarounds that address this vulnerability. Fixed Software Cisco has released free software updates that address the vulnerability described in this advisory. Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license: https://www.cisco.com/c/en/us/products/end-user-license-agreement.html Additionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades. When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories and Alerts page, to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers. Customers Without Service Contracts Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade. Fixed Releases Customers are advised to upgrade to an appropriate release as indicated in the applicable table in this section. In the following table(s), the left column lists major releases of Cisco AsyncOS Software. The right column indicates whether a release is affected by the vulnerability described in this advisory and the first release that includes the fix for this vulnerability. Cisco ESA: CSCvo89192 Cisco AsyncOS Major Software Release First Fixed Release Earlier than 111 Migrate to 11.0.3-251 11 11.0.3-251 12 12.5.0-059 13 Not vulnerable 1. Cisco AsyncOS Software releases earlier than Release 11 have reached end of software maintenance. Customers are advised to migrate to a supported release that includes the fix for this vulnerability. Cisco SMA: CSCvo89182 Cisco AsyncOS Major Software Release First Fixed Release Earlier than 111 Migrate to 11.0.1-161 11 11.0.1-161 12 12.5.0-633 13 Not vulnerable 1. Cisco AsyncOS Software releases earlier than Release 11 have reached end of software maintenance. Customers are advised to migrate to a supported release that includes the fix for this vulnerability. Cisco Cloud Email Security (CES) includes Cisco ESA and Cisco SMA devices as part of the service solution. Cisco provides regular maintenance of the products included in this solution. Customers can also request a software upgrade by contacting Cisco CES support. Exploitation and Public Announcements The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. Source This vulnerability was found during the resolution of a Cisco TAC support case. URL https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200219-esa-sma-dos Revision History Version Description Section Status Date 1.0 Initial public release. — Final 2020-February-19 Legal Disclaimer THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. ________________________________________________________________________ Cisco Email Security Appliance Denial of Service Vulnerability High Advisory ID: cisco-sa-20200219-esa-dos First Published: 2020 February 19 16:00 GMT Version 1.0: Final Workarounds: No workarounds available Cisco Bug IDs: CSCvq03793 CVSS Score: Base 8.6 CVE-2019-1947 CWE-20 Summary A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause the CPU utilization to increase to 100 percent, causing a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of email messages that contain large attachments. An attacker could exploit this vulnerability by sending a malicious email message through the targeted device. A successful exploit could allow the attacker to cause a permanent DoS condition due to high CPU utilization. This vulnerability may require manual intervention to recover the ESA. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200219-esa-dos Affected Products Vulnerable Products This vulnerability affects Cisco AsyncOS Software 12.1.0-085 and 11.1.0-131 for Cisco Email Security Appliance (ESA). Products Confirmed Not Vulnerable Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability. Cisco has confirmed that this vulnerability does not affect the following products: Content Security Management Appliance (SMA), virtual and hardware devices Web Security Appliance (WSA), virtual and hardware devices Indicators of Compromise The indicator of compromise for this vulnerability is a high CPU utilization, which can lead to memory exhaustion. To determine whether there is a high CPU utilization, use the status detail command in the Cisco ESA CLI. The value of the MGA CPU field may show a high percentage value, as shown in the following example: # status detail Gauges: Current System RAM Utilization 43% Overall CPU load average 3% CPU Utilization MGA 100% Anti-Spam 22% Anti-Virus 0% Reporting 0% Quarantine 0% Workarounds There are no workarounds that address this vulnerability. Fixed Software Cisco has released free software updates that address the vulnerability described in this advisory. Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license: https://www.cisco.com/c/en/us/products/end-user-license-agreement.html Additionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades. When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories and Alerts page, to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers. Customers Without Service Contracts Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade. Fixed Releases This vulnerability is fixed in Cisco AsyncOS Software for ESA 12.5.0-059 and later. Cisco Cloud Email Security (CES) includes the Cisco ESA and Cisco SMA as part of the service solution. Cisco provides regular maintenance of the products included in this solution. Customers can also request a software upgrade by contacting Cisco CES support. Exploitation and Public Announcements The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. Source This vulnerability was found during the resolution of a Cisco TAC support case. URL https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200219-esa-dos Revision History Version Description Section Status Date 1.0 Initial public release. — Final 2020-February-19 Legal Disclaimer THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================