« Volver al listado

CVE-2015-6291

Estado: ModificadaAlta (7.8)—

Cisco AsyncOS before 8.5.7-043, 9.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-046 on Email Security Appliance (ESA) devices mishandles malformed fields during body-contains, attachment-contains, every-attachment-contains, attachment-binary-contains, dictionary-match, and attachment-dictionary-match filtering, which allows remote attackers to cause a denial of service (memory consumption) via a crafted attachment in an e-mail message, aka Bug ID CSCuv47151.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cisco — Email Security Appliance

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-6291",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-11-06T03:59:00.090",
  "references": [
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151104-esa2",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1034064",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151104-esa2",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1034064",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cisco AsyncOS before 8.5.7-043, 9.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-046 on Email Security Appliance (ESA) devices mishandles malformed fields during body-contains, attachment-contains, every-attachment-contains, attachment-binary-contains, dictionary-match, and attachment-dictionary-match filtering, which allows remote attackers to cause a denial of service (memory consumption) via a crafted attachment in an e-mail message, aka Bug ID CSCuv47151."
    },
    {
      "lang": "es",
      "value": "Cisco AsyncOS en versiones anteriores a 8.5.7-043, 9.x en versiones anteriores a 9.1.1-023 y 9.5.x y 9.6.x en versiones anteriores a 9.6.0-046 en dispositivos Email Security Appliance (ESA) no maneja correctamente los campos mal formados durante el filtrado body-contains, attachment-contains, every-attachment-contains, attachment-binary-contains, dictionary-match y attachment-dictionary-match, lo que permite a atacantes remotos causar una denegación de servicio (consumo de memoria) a través de un archivo adjunto manipulado en un mensaje de correo electrónico, también conocido como Bug ID CSCuv47151."
    }
  ],
  "lastModified": "2026-06-17T00:30:39.000",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:email_security_appliance:7.7.0-000:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E6096CDB-3908-4E75-A9B6-285738C582B1"
            },
            {
              "criteria": "cpe:2.3:a:cisco:email_security_appliance:7.7.1-000:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "38B13FE0-91B3-48AC-83D5-839E9C49AF10"
            },
            {
              "criteria": "cpe:2.3:a:cisco:email_security_appliance:8.0_base:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D070904-FF6A-4356-A6B9-FC572CF4ADEA"
            },
            {
              "criteria": "cpe:2.3:a:cisco:email_security_appliance:8.5.6-052:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A511EEC7-A7B4-46A0-9182-42B6FFB0E103"
            },
            {
              "criteria": "cpe:2.3:a:cisco:email_security_appliance:8.5.6-073:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2E8A45A9-0835-4F4D-99D1-4E894EE95B5E"
            },
            {
              "criteria": "cpe:2.3:a:cisco:email_security_appliance:8.5.6-074:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C69F7FA3-F8FD-430F-B70C-FBFC3C1A2D04"
            },
            {
              "criteria": "cpe:2.3:a:cisco:email_security_appliance:8.5.6-106:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5EFD829C-2BA8-4EA6-A846-74776A05D105"
            },
            {
              "criteria": "cpe:2.3:a:cisco:email_security_appliance:8.5.6-113:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1A831B2A-A23C-4BB4-B64C-ADD2C77D96E3"
            },
            {
              "criteria": "cpe:2.3:a:cisco:email_security_appliance:8.5.7-042:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "46895808-4225-42FB-BA8B-12ADFADAB4AA"
            },
            {
              "criteria": "cpe:2.3:a:cisco:email_security_appliance:8.5_base:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3EA9AAE6-F3E0-4BB4-9BD9-416742279514"
            },
            {
              "criteria": "cpe:2.3:a:cisco:email_security_appliance:9.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DE6412D3-E788-45F8-B4E5-4795CD88F3C9"
            },
            {
              "criteria": "cpe:2.3:a:cisco:email_security_appliance:9.0.0-212:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79408E18-14BE-486A-AAD1-95A3871CCD21"
            },
            {
              "criteria": "cpe:2.3:a:cisco:email_security_appliance:9.0.0-461:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "44F4ABDB-16DC-4D8F-B2D8-9724133F40BB"
            },
            {
              "criteria": "cpe:2.3:a:cisco:email_security_appliance:9.0.5-000:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F8A2F388-FFE1-43BD-A9B6-D21043F86AA2"
            },
            {
              "criteria": "cpe:2.3:a:cisco:email_security_appliance:9.1.0-032:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "22602224-5873-4B62-A3B4-66B9E590B73E"
            },
            {
              "criteria": "cpe:2.3:a:cisco:email_security_appliance:9.6.0-042:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ED373FBD-1BB7-4532-946F-9DA2DF33A8D1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}