CVE-2016-6358: Input Validation

Published Oct 28, 2016

Updated

A vulnerability in local FTP to the Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a partial denial of service (DoS) condition when the FTP application unexpectedly quits. More Information: CSCux68539. Known Affected Releases: 9.1.0-032 9.7.1-000. Known Fixed Releases: 9.1.1-038.

Affected Software

6 affected components

Cisco Email Security Appliance=9.7.1-066

Cisco Email Security Appliance=9.7.2-046

Cisco Email Security Appliance=9.7.2-047

Cisco Email Security Appliance=9.7.2-054

Cisco Email Security Appliance=9.9.6-026

Cisco Email Security Appliance=9.9_base

Event History

Oct 28, 2016

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2016-6358?

CVE-2016-6358 is classified as a denial of service vulnerability.

How do I fix CVE-2016-6358?

To fix CVE-2016-6358, upgrade your Cisco Email Security Appliance to a version not affected by this vulnerability.

What causes CVE-2016-6358?

CVE-2016-6358 is caused by a flaw in the FTP application on the Cisco Email Security Appliance that can lead to unexpected application quits.

Which Cisco Email Security Appliance versions are affected by CVE-2016-6358?

CVE-2016-6358 affects specific versions including 9.1.0-032, 9.7.1-000, and others listed in the vulnerability details.

Can CVE-2016-6358 be exploited remotely?

Yes, CVE-2016-6358 can be exploited by an unauthenticated remote attacker.