CVE-2014-2119: High severity Cisco IronPort AsyncOS vulnerability
The End User Safelist/Blocklist (aka SLBL) service in Cisco AsyncOS Software for Email Security Appliance (ESA) before 7.6.3-023 and 8.x before 8.0.1-023 and Cisco Content Security Management Appliance (SMA) before 7.9.1-110 and 8.x before 8.1.1-013 allows remote authenticated users to execute arbitrary code with root privileges via an FTP session that uploads a modified SLBL database file, aka Bug IDs CSCug79377 and CSCug80118.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2119?
CVE-2014-2119 is classified as a medium severity vulnerability.
How do I fix CVE-2014-2119?
To fix CVE-2014-2119, upgrade your Cisco AsyncOS to versions 7.6.3-023, 8.0.1-023, or later.
Who is affected by CVE-2014-2119?
CVE-2014-2119 affects users of Cisco AsyncOS for Email Security Appliance prior to 7.6.3-023 and version 8.x before 8.0.1-023.
What type of vulnerability is CVE-2014-2119?
CVE-2014-2119 is a remote authenticated command execution vulnerability.
What devices are impacted by CVE-2014-2119?
CVE-2014-2119 impacts Cisco Email Security Appliances, Cisco Content Security Management Appliances, and specific versions of Cisco AsyncOS.