CVE-2016-6356: Input Validation

Published Oct 28, 2016
·
Updated

A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthenticated, remote attacker to cause an affected device to stop scanning and forwarding email messages due to a denial of service (DoS) condition. Affected Products: This vulnerability affects all releases prior to the first fixed release of Cisco AsyncOS Software for Cisco Email Security Appliances, both virtual and hardware appliances, if the software is configured to apply a message filter or content filter to incoming email attachments. The vulnerability is not limited to any specific rules or actions for a message filter or content filter. More Information: CSCuz63143. Known Affected Releases: 8.5.7-042 9.7.0-125. Known Fixed Releases: 10.0.0-125 9.1.1-038 9.7.2-047.

Affected Software

56 affected components
Cisco Email Security Appliance=3.3.1-09
Cisco Email Security Appliance=7.1.0
Cisco Email Security Appliance=7.1.1
Cisco Email Security Appliance=7.1.2
Cisco Email Security Appliance=7.1.3
Cisco Email Security Appliance=7.1.4
Cisco Email Security Appliance=7.1.5
Cisco Email Security Appliance=7.3.0
Cisco Email Security Appliance=7.3.1
Cisco Email Security Appliance=7.3.2
Cisco Email Security Appliance=7.5.0
Cisco Email Security Appliance=7.5.1
Cisco Email Security Appliance=7.5.2
Cisco Email Security Appliance=7.5.2-201
Cisco Email Security Appliance=7.6.0
Cisco Email Security Appliance=7.6.1-000
Cisco Email Security Appliance=7.6.1-gpl-022
Cisco Email Security Appliance=7.6.2
Cisco Email Security Appliance=7.6.3-000
Cisco Email Security Appliance=7.6.3-025
Cisco Email Security Appliance=7.7.0-000
Cisco Email Security Appliance=7.7.1-000
Cisco Email Security Appliance=7.8.0
Cisco Email Security Appliance=7.8.0-311
Cisco Email Security Appliance=8.0.1-023
Cisco Email Security Appliance=8.0_base
Cisco Email Security Appliance=8.5.0-000
Cisco Email Security Appliance=8.5.0-er1-198
Cisco Email Security Appliance=8.5.6-052
Cisco Email Security Appliance=8.5.6-073
Cisco Email Security Appliance=8.5.6-074
Cisco Email Security Appliance=8.5.6-106
Cisco Email Security Appliance=8.5.6-113
Cisco Email Security Appliance=8.5.7-042
Cisco Email Security Appliance=8.6.0
Cisco Email Security Appliance=8.6.0-011
Cisco Email Security Appliance=8.9.0
Cisco Email Security Appliance=8.9.1-000
Cisco Email Security Appliance=8.9.2-032
Cisco Email Security Appliance=9.0.0
Cisco Email Security Appliance=9.0.0-212
Cisco Email Security Appliance=9.0.0-461
Cisco Email Security Appliance=9.0.5-000
Cisco Email Security Appliance=9.1.0
Cisco Email Security Appliance=9.1.0-011
Cisco Email Security Appliance=9.1.0-032
Cisco Email Security Appliance=9.1.0-101
Cisco Email Security Appliance=9.4.0
Cisco Email Security Appliance=9.4.4-000
Cisco Email Security Appliance=9.5.0-000
Cisco Email Security Appliance=9.5.0-201
Cisco Email Security Appliance=9.6.0-000
Cisco Email Security Appliance=9.6.0-042
Cisco Email Security Appliance=9.6.0-051
Cisco Email Security Appliance=9.7.0-125
Cisco Email Security Appliance=9.7.1-066

Event History

Oct 28, 2016
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
DescriptionWeakness

Frequently Asked Questions

1

What is the severity of CVE-2016-6356?

CVE-2016-6356 is rated as critical due to its potential for causing a denial of service condition.

2

How do I fix CVE-2016-6356?

To fix CVE-2016-6356, upgrade to a fixed version of the Cisco Email Security Appliance Firmware as recommended in the advisories.

3

Which Cisco Email Security Appliance versions are affected by CVE-2016-6356?

CVE-2016-6356 affects multiple versions, including 3.3.1-09 and various versions from 7.1.0 to 9.7.1-066.

4

What kind of attack does CVE-2016-6356 allow?

CVE-2016-6356 allows an unauthenticated remote attacker to disrupt email scanning and forwarding services.

5

Is there a workaround for CVE-2016-6356?

No specific workarounds are provided for CVE-2016-6356, hence upgrading firmware is recommended.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203