CVE-2017-12218 : Security Advisory and Response
Learn about CVE-2017-12218 affecting Cisco Email Security Appliance. Discover how attackers exploit the malware detection flaw, its impact, affected systems, and mitigation steps.
Cisco Email Security Appliance is affected by a vulnerability in the malware detection feature of Cisco AsyncOS Software. This flaw could allow a remote attacker to send malicious email attachments to recipients.
Understanding CVE-2017-12218
A vulnerability in the Advanced Malware Protection (AMP) component of Cisco Email Security Appliances (ESAs) could be exploited by an unauthenticated remote attacker.
What is CVE-2017-12218?
The flaw in the malware detection feature of Cisco AsyncOS Software for Cisco Email Security Appliances allows attackers to bypass email message and content filtering, delivering malware to recipients through specially crafted EML attachments.
The Impact of CVE-2017-12218
- Remote attackers can exploit the vulnerability without authentication
- Malicious email attachments containing malware can be delivered to end users
- Bypassing of configured ESA email message and content filtering
Technical Details of CVE-2017-12218
Cisco Email Security Appliance is affected by a critical vulnerability in the AMP component of AsyncOS Software.
Vulnerability Description
- AMP fails to properly scan certain EML attachments containing malicious code
- Attackers can exploit the flaw by sending crafted EML attachments through the device
Affected Systems and Versions
- Cisco AsyncOS Software for Cisco ESA (virtual and hardware appliances)
- Configured with message or content filters to scan incoming email attachments
Exploitation Mechanism
- Attacker sends an email with a specially crafted EML attachment
- Bypasses configured ESA email message and content filtering
- Malware is delivered to the recipient
Mitigation and Prevention
Immediate Steps to Take:
- Apply patches and updates from Cisco
- Disable AMP feature if not critical for operations
Long-Term Security Practices:
- Regularly update security software and firmware
- Conduct security awareness training for employees
Patching and Updates:
- Cisco has released patches to address the vulnerability
- Regularly check for updates and apply them promptly