Recent Vulnerabilities Research Posts Trends Blog About Contact

Published: 19/10/2014 Updated: 22/10/2014

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

The ZIP inspection engine in Cisco AsyncOS 8.5 and previous versions on the Cisco Email Security Appliance (ESA) does not properly analyze ZIP archives, which allows remote malicious users to bypass malware filtering via a crafted archive, aka Bug ID CSCup07934.

Vulnerable Product	Search on Vulmon	Subscribe to Product
cisco asyncos

A vulnerability in the ZIP inspection engine of Cisco AsyncOS for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the engine protection and deliver malicious ZIP files The vulnerability is due to improper implementation of the logic for analyzing the content of a ZIP file An attacker could exploit t ...

CWE-264 http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3381 http://tools.cisco.com/security/center/viewAlert.x?alertId=36062 https://nvd.nist.gov http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20141014-CVE-2014-3381

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2014-3381

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect