CVE-2014-3381

The ZIP inspection engine in Cisco AsyncOS 8.5 and earlier on the Cisco Email Security Appliance (ESA) does not properly analyze ZIP archives, which allows remote attackers to bypass malware filtering via a crafted archive, aka Bug ID CSCup07934.

Score

CVSS 2.0 5.0 Medium

Status

Modified - psirt@cisco.com

Published

2014-10-19

Last modified

2024-08-06

Weaknesses

CWE-264

Affected products

• Asyncos (Cisco)

References

• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3381
• http://tools.cisco.com/security/center/viewAlert.x?alertId=36062