{"id":1303,"date":"2022-06-17T13:49:26","date_gmt":"2022-06-17T06:49:26","guid":{"rendered":"https:\/\/dt-corp.com.vn\/?p=1303"},"modified":"2022-06-17T13:49:26","modified_gmt":"2022-06-17T06:49:26","slug":"cisco-va-lo-hong-nghiem-trong-trong-thiet-bi-email-security-appliance-esa","status":"publish","type":"post","link":"https:\/\/dt-corp.com.vn\/?p=1303","title":{"rendered":"Cisco v\u00e1 l\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng trong thi\u1ebft b\u1ecb Email Security Appliance (ESA)"},"content":{"rendered":"

G\u1ea7n \u0111\u00e2y, Cisco \u0111\u00e3 ph\u00e1t h\u00e0nh c\u00e1c b\u1ea3n v\u00e1 cho m\u1ed9t l\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn c\u00e1c s\u1ea3n ph\u1ea9m Email Security Appliance (ESA) v\u00e0 Secure Email and Web Manager.<\/b><\/p>\n

\n
\"Screenshot<\/div>\n

\u200b<\/p><\/div>\n

C\u00f3 m\u00e3 \u0111\u1ecbnh danh CVE-2022-20798 (CVSS 9,8), l\u1ed7i c\u00f3 th\u1ec3 b\u1ecb khai th\u00e1c t\u1eeb xa \u0111\u1ec3 v\u01b0\u1ee3t qua x\u00e1c th\u1ef1c v\u00e0 \u0111\u0103ng nh\u1eadp v\u00e0o giao di\u1ec7n qu\u1ea3n l\u00fd web c\u1ee7a c\u00e1c thi\u1ebft b\u1ecb b\u1ecb \u1ea3nh h\u01b0\u1edfng.<\/p>\n

Cisco cho bi\u1ebft: “L\u1ed7 h\u1ed5ng b\u1eaft ngu\u1ed3n t\u1eeb vi\u1ec7c ki\u1ec3m tra x\u00e1c th\u1ef1c kh\u00f4ng \u0111\u00fang c\u00e1ch khi m\u1ed9t thi\u1ebft b\u1ecb s\u1eed d\u1ee5ng Lightweight Directory Access Protocol (LDAP) cho vi\u1ec7c x\u00e1c th\u1ef1c b\u00ean ngo\u00e0i. Hacker c\u00f3 th\u1ec3 khai th\u00e1c l\u1ed7i n\u00e0y b\u1eb1ng c\u00e1ch \u0111i\u1ec1n m\u1ed9t tham s\u1ed1 \u0111\u1ea7u v\u00e0o x\u00e1c \u0111\u1ecbnh v\u00e0o trang \u0111\u0103ng nh\u1eadp c\u1ee7a thi\u1ebft b\u1ecb b\u1ecb \u1ea3nh h\u01b0\u1edfng.<\/i>”<\/p>\n

Theo Cisco, c\u1ea3 thi\u1ebft b\u1ecb \u1ea3o v\u00e0 ph\u1ea7n c\u1ee9ng ch\u1ea1y b\u1ea3n ph\u00e1t h\u00e0nh ph\u1ea7n m\u1ec1m Cisco AsyncOS \u0111\u1ec1u b\u1ecb \u1ea3nh h\u01b0\u1edfng n\u1ebfu x\u00e1c th\u1ef1c b\u00ean ngo\u00e0i \u0111\u01b0\u1ee3c b\u1eadt v\u00e0 LDAP \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng l\u00e0m giao th\u1ee9c x\u00e1c th\u1ef1c.<\/p>\n

Kh\u00e1ch h\u00e0ng n\u00ean c\u1eadp nh\u1eadt Secure Email and Web Manage l\u00ean phi\u00ean b\u1ea3n AsyncOS 13.0.0-277, 13.6.2-090, 13.8.1-090, 14.0.0-418 ho\u1eb7c 14.1.0-250, v\u00e0 c\u1eadp nh\u1eadt ESA l\u00ean AsyncOS 14.0.1-033.<\/p>\n

Cisco c\u0169ng c\u00f4ng b\u1ed1 c\u00e1c b\u1ea3n v\u00e1 cho m\u1ed9t v\u1ea5n \u0111\u1ec1 nghi\u00eam tr\u1ecdng cao trong ESA v\u00e0 Secure Email and Web Manager c\u00f3 th\u1ec3 cho ph\u00e9p hacker truy xu\u1ea5t th\u00f4ng tin t\u1eeb m\u00e1y ch\u1ee7 LDAP cho vi\u1ec7c x\u00e1c th\u1ef1c b\u00ean ngo\u00e0i \u0111\u01b0\u1ee3c k\u1ebft n\u1ed1i v\u1edbi m\u1ed9t thi\u1ebft b\u1ecb \u1ea3nh h\u01b0\u1edfng.<\/p>\n

L\u1ed7 h\u1ed5ng CVE-2022-20664 (CVSS 7,7), t\u1ed3n t\u1ea1i do d\u1eef li\u1ec7u \u0111\u1ea7u v\u00e0o kh\u00f4ng \u0111\u01b0\u1ee3c ki\u1ec3m so\u00e1t ch\u1eb7t ch\u1ebd khi truy v\u1ea5n m\u00e1y ch\u1ee7 x\u00e1c th\u1ef1c b\u00ean ngo\u00e0i.<\/p>\n

Cisco v\u00e1 l\u1ed7i n\u00e0y b\u1eb1ng vi\u1ec7c ph\u00e1t h\u00e0nh AsyncOS 13.6.2-090 v\u00e014.1.0-227 cho Secure Email and Web Manager, c\u0169ng nh\u01b0 AsyncOS 14.0.1-020 cho ESA.<\/p>\n

Ngo\u00e0i ra, Cisco c\u1ea3nh b\u00e1o r\u1eb1ng h\u00e3ng kh\u00f4ng c\u00f3 k\u1ebf ho\u1ea1ch gi\u1ea3i quy\u1ebft l\u1ed7 h\u1ed5ng an ninh (CVE-2022-20825, CVSS 9.) nghi\u00eam tr\u1ecdng trong c\u00e1c b\u1ed9 \u0111\u1ecbnh tuy\u1ebfn RV110W, RV130, RV130W v\u00e0 RV215W d\u00e0nh cho oanh nghi\u1ec7p nh\u1ecf.<\/p>\n

CVE-2022-20825 b\u1eaft ngu\u1ed3n t\u1eeb vi\u1ec7c ki\u1ec3m so\u00e1t kh\u00f4ng \u0111\u1ea7y \u0111\u1ee7 d\u1eef li\u1ec7u \u0111\u1ea7u v\u00e0o c\u1ee7a ng\u01b0\u1eddi d\u00f9ng trong c\u00e1c g\u00f3i HTTP, cho ph\u00e9p hacker g\u1eedi c\u00e1c y\u00eau c\u1ea7u \u0111\u01b0\u1ee3c ch\u1ebf t\u1ea1o \u0111\u1eb7c bi\u1ec7t \u0111\u1ebfn giao di\u1ec7n qu\u1ea3n l\u00fd d\u1ef1a tr\u00ean web c\u1ee7a c\u00e1c b\u1ed9 \u0111\u1ecbnh tuy\u1ebfn b\u1ecb \u1ea3nh h\u01b0\u1edfng, d\u1eabn \u0111\u1ebfn th\u1ef1c thi m\u00e3 t\u1eeb xa ho\u1eb7c t\u1ea5n c\u00f4ng t\u1eeb ch\u1ed1i d\u1ecbch v\u1ee5.<\/p>\n

Theo:\u00a0<\/b>securityweek<\/b><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

G\u1ea7n \u0111\u00e2y, Cisco \u0111\u00e3 ph\u00e1t h\u00e0nh c\u00e1c b\u1ea3n v\u00e1 cho m\u1ed9t l\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn c\u00e1c s\u1ea3n ph\u1ea9m Email Security Appliance (ESA) v\u00e0 Secure Email and Web Manager. \u200b C\u00f3","protected":false},"author":3,"featured_media":1304,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[13],"tags":[],"class_list":["post-1303","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/dt-corp.com.vn\/wp-content\/uploads\/2022\/06\/Screenshot-2022-06-17-092424.jpg","_links":{"self":[{"href":"https:\/\/dt-corp.com.vn\/index.php?rest_route=\/wp\/v2\/posts\/1303","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dt-corp.com.vn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dt-corp.com.vn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dt-corp.com.vn\/index.php?rest_route=\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/dt-corp.com.vn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1303"}],"version-history":[{"count":1,"href":"https:\/\/dt-corp.com.vn\/index.php?rest_route=\/wp\/v2\/posts\/1303\/revisions"}],"predecessor-version":[{"id":1305,"href":"https:\/\/dt-corp.com.vn\/index.php?rest_route=\/wp\/v2\/posts\/1303\/revisions\/1305"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dt-corp.com.vn\/index.php?rest_route=\/wp\/v2\/media\/1304"}],"wp:attachment":[{"href":"https:\/\/dt-corp.com.vn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1303"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dt-corp.com.vn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1303"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dt-corp.com.vn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1303"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}