CVE-2016-1405 - Vulnerability Details - OpenCVE

libclamav in ClamAV (aka Clam AntiVirus), as used in Advanced Malware Protection (AMP) on Cisco Email Security Appliance (ESA) devices before 9.7.0-125 and Web Security Appliance (WSA) devices before 9.0.1-135 and 9.1.x before 9.1.1-041, allows remote attackers to cause a denial of service (AMP process restart) via a crafted document, aka Bug IDs CSCuv78533 and CSCuw60503.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Cisco	Email Security Appliance Web Security Appliance
Clamav	Clamav

Configuration 1 [-]

AND

cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*

OR	cpe:2.3:a:cisco:email_security_appliance:9.6.0-042:::::::*
	cpe:2.3:a:cisco:web_security_appliance:8.8.0-085:::::::*
	cpe:2.3:a:cisco:web_security_appliance:9.1.0-070:::::::*
	cpe:2.3:a:cisco:web_security_appliance:9.5.0-284:::::::*

No data.

References

Link	Providers
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160531-wsa-esa
http://www.securityfocus.com/bid/90968
http://www.securitytracker.com/id/1035993
http://www.securitytracker.com/id/1035994
http://www.ubuntu.com/usn/USN-3093-1
https://github.com/vrtadmin/clamav-devel/blob/master/ChangeLog

History

No history.

MITRE

Status: PUBLISHED

Assigner: cisco

Published: 2016-06-08T14:00:00

Updated: 2024-08-05T22:55:14.552Z

Reserved: 2016-01-04T00:00:00

Link: CVE-2016-1405

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2016-06-08T14:59:12.827

Modified: 2025-04-12T10:46:40.837

Link: CVE-2016-1405

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-05-31T00:00:00", "descriptions": [{"lang": "en", "value": "libclamav in ClamAV (aka Clam AntiVirus), as used in Advanced Malware Protection (AMP) on Cisco Email Security Appliance (ESA) devices before 9.7.0-125 and Web Security Appliance (WSA) devices before 9.0.1-135 and 9.1.x before 9.1.1-041, allows remote attackers to cause a denial of service (AMP process restart) via a crafted document, aka Bug IDs CSCuv78533 and CSCuw60503."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2016-11-25T19:57:01", "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco"}, "references": [{"name": "90968", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/90968"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/vrtadmin/clamav-devel/blob/master/ChangeLog"}, {"name": "USN-3093-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/USN-3093-1"}, {"name": "1035993", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1035993"}, {"name": "20160531 Cisco ESA and WSA AMP ClamAV Denial of Service Vulnerability", "tags": ["vendor-advisory", "x_refsource_CISCO"], "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160531-wsa-esa"}, {"name": "1035994", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1035994"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@cisco.com", "ID": "CVE-2016-1405", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "libclamav in ClamAV (aka Clam AntiVirus), as used in Advanced Malware Protection (AMP) on Cisco Email Security Appliance (ESA) devices before 9.7.0-125 and Web Security Appliance (WSA) devices before 9.0.1-135 and 9.1.x before 9.1.1-041, allows remote attackers to cause a denial of service (AMP process restart) via a crafted document, aka Bug IDs CSCuv78533 and CSCuw60503."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "90968", "refsource": "BID", "url": "http://www.securityfocus.com/bid/90968"}, {"name": "https://github.com/vrtadmin/clamav-devel/blob/master/ChangeLog", "refsource": "MISC", "url": "https://github.com/vrtadmin/clamav-devel/blob/master/ChangeLog"}, {"name": "USN-3093-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-3093-1"}, {"name": "1035993", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1035993"}, {"name": "20160531 Cisco ESA and WSA AMP ClamAV Denial of Service Vulnerability", "refsource": "CISCO", "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160531-wsa-esa"}, {"name": "1035994", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1035994"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T22:55:14.552Z"}, "title": "CVE Program Container", "references": [{"name": "90968", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/90968"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/vrtadmin/clamav-devel/blob/master/ChangeLog"}, {"name": "USN-3093-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "http://www.ubuntu.com/usn/USN-3093-1"}, {"name": "1035993", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1035993"}, {"name": "20160531 Cisco ESA and WSA AMP ClamAV Denial of Service Vulnerability", "tags": ["vendor-advisory", "x_refsource_CISCO", "x_transferred"], "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160531-wsa-esa"}, {"name": "1035994", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1035994"}]}]}, "cveMetadata": {"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "cveId": "CVE-2016-1405", "datePublished": "2016-06-08T14:00:00", "dateReserved": "2016-01-04T00:00:00", "dateUpdated": "2024-08-05T22:55:14.552Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*", "matchCriteriaId": "2A4628C3-55C5-4B29-9B9F-7034B0670C76", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:email_security_appliance:9.6.0-042:*:*:*:*:*:*:*", "matchCriteriaId": "ED373FBD-1BB7-4532-946F-9DA2DF33A8D1", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:web_security_appliance:8.8.0-085:*:*:*:*:*:*:*", "matchCriteriaId": "4F98FEDA-89EF-40BA-BBD3-3EBD6DD33EE6", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:web_security_appliance:9.1.0-070:*:*:*:*:*:*:*", "matchCriteriaId": "8782B7BC-03C5-4866-9807-14EF9A818EB1", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:web_security_appliance:9.5.0-284:*:*:*:*:*:*:*", "matchCriteriaId": "4BA50ED3-74F8-4B13-BFA9-97EA6B43C701", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "libclamav in ClamAV (aka Clam AntiVirus), as used in Advanced Malware Protection (AMP) on Cisco Email Security Appliance (ESA) devices before 9.7.0-125 and Web Security Appliance (WSA) devices before 9.0.1-135 and 9.1.x before 9.1.1-041, allows remote attackers to cause a denial of service (AMP process restart) via a crafted document, aka Bug IDs CSCuv78533 and CSCuw60503."}, {"lang": "es", "value": "libclamav en ClamAV (tambi\u00e9n conocida como Clam AntiVirus), tal como se utiliza en Advanced Malware Protection (AMP) en dispositivos Cisco Email Security Appliance (ESA) en versiones anteriores a 9.7.0-125 y dispositivos Web Security Appliance (WSA) en versiones anteriores a 9.0.1-135 y 9.1.x en versiones anteriores a 9.1.1-041, permite a atacantes remotos provocar una denegaci\u00f3n de servicio (reinicio del proceso AMP) a trav\u00e9s de un documento manipulado, tambi\u00e9n conocido como Bug IDs CSCuv78533 y CSCuw60503."}], "id": "CVE-2016-1405", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": true, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-06-08T14:59:12.827", "references": [{"source": "psirt@cisco.com", "tags": ["Vendor Advisory"], "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160531-wsa-esa"}, {"source": "psirt@cisco.com", "url": "http://www.securityfocus.com/bid/90968"}, {"source": "psirt@cisco.com", "url": "http://www.securitytracker.com/id/1035993"}, {"source": "psirt@cisco.com", "url": "http://www.securitytracker.com/id/1035994"}, {"source": "psirt@cisco.com", "url": "http://www.ubuntu.com/usn/USN-3093-1"}, {"source": "psirt@cisco.com", "url": "https://github.com/vrtadmin/clamav-devel/blob/master/ChangeLog"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160531-wsa-esa"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/90968"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id/1035993"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id/1035994"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.ubuntu.com/usn/USN-3093-1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/vrtadmin/clamav-devel/blob/master/ChangeLog"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "nvd@nist.gov", "type": "Primary"}]}