Vulnslist

find the latest Cisco vulnerabilities

Cisco Security Appliances AsyncOS Software Update Server Certificate Validation Vulnerability

cisco-sa-20161207-asyncos · Medium · Published · Updated

A vulnerability in the update functionality of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA), Cisco Web Security Appliance (WSA), and Cisco Content Management Security Appliance (SMA) could allow an unauthenticated, remote attacker to impersonate the update server. The vulnerability is due to a lack of certificate validation during the HTTPS connection toward the repository from which the update manifests are retrieved. An attacker could exploit this vulnerability by performing a man-in-the-middle attack (such as DNS hijacking) and impersonating the update server. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-asyncos

Cisco advisory ·CSAF JSON

Workarounds

There are no workarounds that address this vulnerability.

CVEsCVE-2016-1411
Cisco Bug IDsCSCul88715, CSCul94617, CSCul94627
CVSS ScoreBase 4.3
Base 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N/E:F/RL:OF/RC:C
Product Names From Source
Cisco Web Security Appliance (WSA), Cisco Email Security Appliance (ESA), Cisco Content Security Management Appliance (SMA), Cisco Secure Email, Cisco Secure Email and Web Manager, Cisco Secure Web Appliance

Related Products

Product CVE Evidence
Cisco Web Security Appliance (WSA) CVE-2016-1411 Cisco OpenVuln
Cisco Secure Web Appliance CVE-2016-1411 Cisco OpenVuln
Cisco Secure Email and Web Manager CVE-2016-1411 Cisco OpenVuln
Cisco Secure Email CVE-2016-1411 Cisco OpenVuln
Cisco Email Security Appliance (ESA) CVE-2016-1411 Cisco OpenVuln
Cisco Content Security Management Appliance (SMA) CVE-2016-1411 Cisco OpenVuln