Cisco warns of exploited critical flaw giving attackers root on email gateways

[Socket]

Cisco has urged customers to patch a critical vulnerability in its Secure Email Gateway that attackers were already exploiting before a fix existed. The Register's Jessica Lyons reports that the flaw is rated 9.8 out of 10. A remote attacker who has not logged in can gain root control of the appliance simply by sending an email with a malicious attachment

The bug sits in the Advanced Malware Protection feature. It affects physical and virtual appliances running vulnerable AsyncOS releases where the File Reputation service is enabled and the Content Scanner Tools version is older than 25.3.0.5525. There is a certain irony in a malware protection feature being the way in

Cisco says a limited number of customers were affected, but has not said how many appliances were compromised. CISA has added the flaw to its catalogue of known exploited vulnerabilities and gave US federal agencies until Saturday to fix it

There is no workaround. Customers must upgrade, and anyone running releases before 16.5 should move to version 16.5.0-780. This is the second Secure Email Gateway zero-day in about two months, following another critical flaw in September

Email gateways sit at the edge of a network and process untrusted content all day, which makes them very attractive targets. Organisations using these appliances should patch quickly and check for any signs of compromise. Two zero-days in two months suggests attackers are paying close attention to this product

How quickly can your organisation patch an edge appliance like this? And is it time to rethink how email security appliances are built?

Cisco make-me-root email bug exploited as a 0-day by unknown crimswww.theregister.com