CVE-2017-12353 (CNNVD-201711-1213)
中文标题:
Cisco Email Security Appliance Cisco AsyncOS Software Multipurpose Internet Mail Extensions scanner 安全漏洞
英文标题:
A vulnerability in the Multipurpose Internet Mail Extensions (MIME) scanner of Cisco AsyncOS Softwar...
漏洞描述
中文描述:
Cisco Email Security Appliance（ESA）是美国思科（Cisco）公司的一个电子邮件安全设备。AsyncOS Software是使用在其中的操作系统。Multipurpose Internet Mail Extensions（MIME）scanner是其中的一个多功能邮件扩展扫描器。 Cisco ESA中的Cisco AsyncOS Software的MIME scanner存在安全漏洞，该漏洞源于程序没有正确的处理邮件附件中畸形的MIME包头。远程攻击者可通过发送带有特制MIME附件的邮件利用该漏洞绕过已配置的用户过滤器。
英文描述:
A vulnerability in the Multipurpose Internet Mail Extensions (MIME) scanner of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to bypass configured user filters on the device. The vulnerability is due to improper error handling of a malformed MIME header in an email attachment. An attacker could exploit this vulnerability by sending an email with a crafted MIME attachment. For example, a successful exploit could allow the attacker to bypass configured user filters to drop the email. The malformed MIME headers may not be RFC compliant. However, some mail clients could still allow users to access the attachment, which may not have been properly filtered by the device. Cisco Bug IDs: CSCvf44666.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| cisco | asyncos | - | - | - |
cpe:2.3:o:cisco:asyncos:-:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2017-12353 |
2025-11-11 15:19:17 | 2025-11-11 07:34:33 |
| NVD | nvd_CVE-2017-12353 |
2025-11-11 14:55:34 | 2025-11-11 07:43:12 |
| CNNVD | cnnvd_CNNVD-201711-1213 |
2025-11-11 15:09:56 | 2025-11-11 07:53:22 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 授权问题
- cnnvd_id: 未提取 -> CNNVD-201711-1213
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- cvss_score: 未提取 -> 5.8
- cvss_vector: NOT_EXTRACTED -> CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
- cvss_version: NOT_EXTRACTED -> 3.0
- affected_products_count: 0 -> 1
- data_sources: ['cve'] -> ['cve', 'nvd']