1. CVE-Search
  2. CVE-2016-1411
ID CVE-2016-1411
Summary A vulnerability in the update functionality of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA), Cisco Web Security Appliance (WSA), and Cisco Content Management Security Appliance (SMA) could allow an unauthenticated, remote attacker to impersonate the update server. More Information: CSCul88715, CSCul94617, CSCul94627. Known Affected Releases: 7.5.2-201 7.6.3-025 8.0.1-023 8.5.0-000 8.5.0-ER1-198 7.5.2-HP2-303 7.7.0-608 7.7.5-835 8.5.1-021 8.8.0-000 7.9.1-102 8.0.0-404 8.1.1-013 8.2.0-222. Known Fixed Releases: 8.0.2-069 8.0.2-074 8.5.7-042 9.1.0-032 8.5.2-027 9.6.1-019.
References
Vulnerable Configurations
  • cpe:2.3:a:cisco:content_security_management_appliance:9.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:cisco:content_security_management_appliance:9.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:content_security_management_appliance:9.1.0-004:*:*:*:*:*:*:*
    cpe:2.3:a:cisco:content_security_management_appliance:9.1.0-004:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:content_security_management_appliance:9.1.0-031:*:*:*:*:*:*:*
    cpe:2.3:a:cisco:content_security_management_appliance:9.1.0-031:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:content_security_management_appliance:9.1.0-033:*:*:*:*:*:*:*
    cpe:2.3:a:cisco:content_security_management_appliance:9.1.0-033:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:content_security_management_appliance:9.1.0-103:*:*:*:*:*:*:*
    cpe:2.3:a:cisco:content_security_management_appliance:9.1.0-103:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:content_security_management_appliance:9.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:cisco:content_security_management_appliance:9.6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:email_security_appliance:7.5.2-201:*:*:*:*:*:*:*
    cpe:2.3:a:cisco:email_security_appliance:7.5.2-201:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:email_security_appliance:7.5.2-hp2-303:*:*:*:*:*:*:*
    cpe:2.3:a:cisco:email_security_appliance:7.5.2-hp2-303:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:email_security_appliance:7.6.3-025:*:*:*:*:*:*:*
    cpe:2.3:a:cisco:email_security_appliance:7.6.3-025:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:email_security_appliance:8.0.1-023:*:*:*:*:*:*:*
    cpe:2.3:a:cisco:email_security_appliance:8.0.1-023:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:email_security_appliance:8.5.0-000:*:*:*:*:*:*:*
    cpe:2.3:a:cisco:email_security_appliance:8.5.0-000:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:email_security_appliance:8.5.0-er1-198:*:*:*:*:*:*:*
    cpe:2.3:a:cisco:email_security_appliance:8.5.0-er1-198:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:email_security_appliance:8.5.1-021:*:*:*:*:*:*:*
    cpe:2.3:a:cisco:email_security_appliance:8.5.1-021:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:web_security_appliance:7.7.0-608:*:*:*:*:*:*:*
    cpe:2.3:a:cisco:web_security_appliance:7.7.0-608:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:web_security_appliance:7.7.5-835:*:*:*:*:*:*:*
    cpe:2.3:a:cisco:web_security_appliance:7.7.5-835:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:web_security_appliance:8.8.0-000:*:*:*:*:*:*:*
    cpe:2.3:a:cisco:web_security_appliance:8.8.0-000:*:*:*:*:*:*:*
CVSS
Base: 4.3 (as of 15-12-2016 - 15:18)
Impact:
Exploitability:
CWE CWE-310
CAPEC
  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
cvss-vector via4 AV:N/AC:M/Au:N/C:N/I:P/A:N
refmap via4
bid 94791
confirm https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-asyncos
Last major update 15-12-2016 - 15:18
Published 14-12-2016 - 00:59
Last modified 15-12-2016 - 15:18
Back to Top