#VU16923 Input validation error in Cisco Email Security Appliance - CVE-2018-15460

Vulnerability identifier: #VU16923

Vulnerability risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-15460

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Cisco Email Security Appliance
Server applications / IDS/IPS systems, Firewalls and proxy servers

Vendor: Cisco Systems, Inc

Description

The vulnerability allows a remote attacker to cause DoS condition.

The vulnerability exists in the email message filtering feature due to improper filtering of email messages that contain references to whitelisted URLs. A remote attacker can send a malicious email message that contains a large number of whitelisted URLs, cause the CPU utilization to increase to 100 percent and force the affected device to stop scanning and forwarding email messages.

Mitigation
The vulnerability has been addressed in the versions 12.0.0-281, 11.1.2-023, 11.0.2-044.

Vulnerable software versions

Cisco Email Security Appliance: 10.0.3 004 - 12.0.0

---

External links
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190109-esa-url-dos

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.