Vulnslist

find the latest Cisco vulnerabilities

Cisco Email Security Appliance URL Filtering Denial of Service Vulnerability

cisco-sa-20190109-esa-url-dos · High · Published · Updated

A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to cause the CPU utilization to increase to 100 percent, causing a denial of service (DoS) condition on an affected device. The vulnerability is due to improper filtering of email messages that contain references to whitelisted URLs. An attacker could exploit this vulnerability by sending a malicious email message that contains a large number of whitelisted URLs. A successful exploit could allow the attacker to cause a sustained DoS condition that could force the affected device to stop scanning and forwarding email messages. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190109-esa-url-dos

Workarounds

There are two possible workarounds to address this vulnerability:

1. If the whitelist through Global URL Filtering is not needed, administrators can disable it by following these steps:

On the ESA, navigate to Security Services > URL Filtering.
Click on Edit Global Settings and set Use a URL whitelist to None. This disables the global whitelist.
Commit the Changes.

2. If the whitelist through Global URL Filtering feature is needed, the same level of filtering can be achieved by implementing a single whitelist per Content Filter, after disabling the whitelist through Global URL Filtering, as described in step 1. Administrators can choose a specific URL Reputation range or set of URL Categories to apply the whitelist to via the Content Filter. The required steps are as follows:

On the ESA, navigate to Mail Policies > Incoming Content Filters
[Optionally] Create a new Content Filter by clicking Add Filter
Click on the desired Content Filter > Add Action > URL Reputation > Select Custom Range

Input the desired range
[Alternatively] Add Action > URL Categories > Add desired Categories set
Choose the desired whitelist
Click OK > Submit
Commit the Changes

CVEsCVE-2018-15460
Cisco Bug IDsCSCvm81627
CVSS ScoreBase 8.6
Base 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:X/RL:X/RC:X
Product Names From Source
Cisco Email Security Appliance (ESA), Cisco Secure Email

Related Products

Product CVE Evidence
Cisco RV Series Routers CVE-2018-15460 Cisco OpenVuln
Cisco Nexus Dashboard CVE-2018-15460 Cisco OpenVuln
Cisco Secure Email CVE-2018-15460 Cisco OpenVuln
Cisco Email Security Appliance (ESA) CVE-2018-15460 Cisco OpenVuln