Cisco Email Security Appliance AsyncOS 输入验证错误漏洞

漏洞信息详情

Cisco Email Security Appliance（ESA）是美国思科（Cisco）公司的一个电子邮件安全设备。AsyncOS Software是运行在其中的一套操作系统。

Cisco ESA 13.0之前版本中的Cisco AsyncOS软件的zip解压缩引擎存在输入验证错误漏洞，该漏洞源于程序没有正确验证zip文件。远程攻击者可借助包含特制zip附件的电子邮件利用该漏洞造成拒绝服务。

目前厂商已发布升级补丁以修复漏洞，补丁获取链接：

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-dos-87mBkc8n

来源:tools.cisco.com

链接:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-email-sec-xss-EbjXuXwP

来源:tools.cisco.com

链接:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-bypass-5Cdv2HMA

来源:tools.cisco.com

链接:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-dos-87mBkc8n

来源:vigilance.fr

链接:https://vigilance.fr/vulnerability/Cisco-ESA-denial-of-service-via-Zip-Decompression-31411

来源:nvd.nist.gov

链接:https://nvd.nist.gov/vuln/detail/CVE-2020-3134

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2020.0235/

暂无