CWE
358
Advisory Published
Updated

CVE-2017-12303

First published: Thu Nov 16 2017(Updated: )

A vulnerability in the Advanced Malware Protection (AMP) file filtering feature of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to bypass a configured AMP file filtering rule. The file types affected are zipped or archived file types. The vulnerability is due to incorrect and different file hash values when AMP scans the file. An attacker could exploit this vulnerability by sending a crafted email file attachment through the targeted device. An exploit could allow the attacker to bypass a configured AMP file filter. Cisco Bug IDs: CSCvf52943.

Credit: ykramarz@cisco.com

Affected SoftwareAffected VersionHow to fix
Cisco AsyncOS=10.1.1-234
Cisco AsyncOS=10.1.1-235

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Frequently Asked Questions

  • What is CVE-2017-12303?

    CVE-2017-12303 is a vulnerability in the Advanced Malware Protection (AMP) file filtering feature of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA).

  • How does CVE-2017-12303 affect Cisco AsyncOS Software?

    CVE-2017-12303 allows an unauthenticated, remote attacker to bypass a configured AMP file filtering rule.

  • What types of file are affected by CVE-2017-12303?

    CVE-2017-12303 affects zipped or archived file types.

  • What is the severity of CVE-2017-12303?

    CVE-2017-12303 has a severity rating of medium, with a severity value of 5.3.

  • How can I fix CVE-2017-12303 in Cisco AsyncOS Software?

    To fix CVE-2017-12303, Cisco recommends upgrading to version 10.1.1-236 or later of Cisco AsyncOS Software.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203