Cisco Releases Security Updates for Multiple Products

Five advisories address one Critical, two High, and three Medium impact vulnerabilities for Cisco Nexus Dashboard, Cisco Secure Email and Web Manager, Cisco ESA, Cisco ISE, and other products

Threat ID:: CC-4266
Threat Severity:: Information only
Published:: 16 February 2023 12:39 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Five advisories address one Critical, two High, and three Medium impact vulnerabilities for Cisco Nexus Dashboard, Cisco Secure Email and Web Manager, Cisco ESA, Cisco ISE, and other products

Affected platforms

The following platforms are known to be affected:

Cisco Nexus Dashboard

Cisco AsyncOS Software for Cisco Secure Email Gateway

Cisco Secure Email and Web Manager

Cisco ISE

The following platforms are also known to be affected:

Secure Endpoint, formerly Advanced Malware Protection (AMP) for Endpoints, for Linux
Secure Endpoint, formerly Advanced Malware Protection (AMP) for Endpoints, for MacOS
Secure Endpoint, formerly Advanced Malware Protection (AMP) for Endpoints, for Windows
Secure Endpoint Private Cloud
Secure Web Appliance, formerly Web Security Appliance

Threat details

Introduction

Five advisories address one Critical, two High, and three Medium impact vulnerabilities in multiple products.

The Critical vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write that could lead to arbitrary code execution with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial-of-service (DoS) condition.

The High vulnerabilities are related to DoS, command injection, and privilege escalation. An unauthenticated, remote attacker could exploit some of these vulnerabilities to take control of a system.

Proof-of-concept releases for CVE-2023-20032

The Cisco Product Security Incident Response Team (PSIRT) is aware that a proof-of-concept is publicly available for CVE-2023-20032, a Critical vulnerability in ClamAV.

Threat updates

Date	Update
23 Feb 2023	Proof-of-concept releases for CVE-2023-20032 This article has been updated to reflect this change.

Remediation advice

Affected organisations are encouraged to review the following Cisco Security Advisories for more information.

Remediation steps

Type	Step
Patch	ClamAV HFS+ Partition Scanning Buffer Overflow Vulnerability Affecting Cisco Products: February 2023 \| cisco-sa-clamav-q8DThCy https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-q8DThCy
Patch	Cisco Nexus Dashboard Denial of Service Vulnerability \| cisco-sa-ndb-dnsdos-bYscZOsu https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndb-dnsdos-bYscZOsu
Patch	Cisco Email Security Appliance and Cisco Secure Email and Web Manager Vulnerabilities \| cisco-sa-esa-sma-privesc-9DVkFpJ8 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-privesc-9DVkFpJ8
Patch	ClamAV DMG File Parsing XML Entity Expansion Vulnerability Affecting Cisco Products: February 2023 \| cisco-sa-clamav-xxe-TcSZduhN https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-xxe-TcSZduhN
Patch	Cisco Nexus Dashboard Cross-Site Scripting Vulnerability \| cisco-sa-nexus-dashboard-xss-xc5BcgsQ https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nexus-dashboard-xss-xc5BcgsQ
Patch	Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerability \| cisco-sa-ise-xss-ubfHG75C https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss-ubfHG75C