MIME Header Processing Vulnerability in Cisco Email and Web Security Appliances

CVE-2016-6372

Summary

A vulnerability exists in the processing of malformed Multipurpose Internet Mail Extensions (MIME) headers within Cisco AsyncOS Software for Email and Web Security Appliances. This flaw permits an unauthenticated remote attacker to bypass critical email filtering mechanisms. Consequently, emails that would typically be quarantined due to security policies may instead be processed normally, posing a significant threat to users by increasing the risk of malicious content being delivered. This vulnerability impacts all prior releases leading up to the fixed versions of Cisco AsyncOS for both virtual and hardware appliances that utilize message or content filters to inspect incoming email attachments.

References