Cisco fixes serious DoS flaws in email security appliance

Cisco patched two serious denial-of-service (DoS) vulnerabilities that can be exploited remotely without authentication in its email security appliances.

One of the flaws, tracked as CVE-2018-15453 can be exploited by sending a malicious S/MIME-signed email through a targeted device. An attacker can cause appliances to reload and enter a DoS condition by sending a specially crafted S/MIME email.

“If Decryption and Verification or Public Key Harvesting is configured, the filtering process could crash due to memory corruption and restart, resulting in a DoS condition. The software could then resume processing the same S/MIME-signed email, causing the filtering process to crash and restart again,” the company explained.

“A successful exploit could allow the attacker to cause a permanent DoS condition. This vulnerability may require manual intervention to recover the ESA.

The second flaw, tracked as CVE-2018-15460 can be exploited by sending a malicious email message that contains a large number of whitelisted URLs. A successful exploit can cause a sustained DoS condition that could force the affected device to stop scanning and forwarding email messages. The flaw allows an attacker to cause a DoS condition by getting CPU usage to increase to 100%.

Both vulnerabilities were discovered by Cisco itself and there is no evidence of malicious exploitation.

Cisco this week also released 16 other advisories describing “medium severity” flaws affecting ASR routers, Webex, IOS, TelePresence, Prime, IP Phone, Jabber, Identity Services Engine, Firepower, Unified Communications Manager, and Policy Suite products.

 

%d bloggers like this: