2022年11月23日

一名匿名研究人員披露了幾種方法，可以用來繞過思科安全郵件網關設備中的一些過濾器，並使用特殊製作的電子郵件發送惡意軟件。在11月14日“完全披露”郵件列表上的一篇文章中，該研究人員表示，他們一直在與該供應商聯係，但聲稱在給定的時間範圍內沒有收到令人滿意的答複。該研究人員表示:“由於攻擊的複雜性較低，而且漏洞已經由第三方發布，因此必須不再拖延將線程公開。”繞過方法依賴於“郵件客戶端的容錯能力和不同的MIME解碼能力”。據研究人員稱，攻擊者可以通過三種不同的方法向受思科安全郵件網關保護的組織發送惡意軟件，這些方法可以針對Outlook、雷鳥、Mutt、Vivaldi和其他電子郵件客戶端。思科針對這些發現發布了一份錯誤報告，澄清了一些過濾功能可以被遠程的、未經身份驗證的攻擊者繞過，這是由於Sophos和McAfee惡意軟件掃描引擎的問題。這家網絡巨頭表示，當以默認配置運行時，該問題會影響其安全電子郵件網關產品(前身為思科電子郵件安全設備(ESA))。“這個問題是由於對潛在惡意郵件或附件的識別不當。攻擊者可以利用這個問題，通過受影響的設備發送帶有畸形內容類型報頭(MIME Type)的惡意電子郵件。利用漏洞可以讓攻擊者繞過基於受影響掃描引擎的默認反惡意軟件過濾功能，並成功地向終端客戶發送惡意消息。” The company told SecurityWeek that this is not a vulnerability in the Secure Email Gateway product itself. “We have recommended a workaround to mitigate the issue in most scenarios,” a Cisco spokesperson said. “Cisco’s anti-malware providers have also committed to provide a fix that will be pushed directly to customers. No actions are needed on the part of the customer. Our top priority is the satisfaction and support of our customers and partners, and we are committed to communicating openly and transparently with our stakeholders.” SecurityWeek has also reached out to Sophos and McAfee for comment. While McAfee has not responded, Sophos said it’s aware of the issue and it has already been working on hardening the integration of its scanning engine with Cisco’s product. The cybersecurity firm noted that, in the meantime, Cisco has provided a workaround for users. The researcher who disclosed the bypass methods pointed to an open source toolkit designed for generating emails that test security products against such attacks. The researcher suggested that the workaround proposed by Cisco does address the methods exploited by the open source tool, but it does not prevent all of them. Security bypass methods involving Multipurpose Internet Mail Extensions (MIME) headers have been known for many years and have been found in the products of several vendors.