Cisco Email Security Appliance Denial of Service Vulnerability

[pbabu6001]

Our C670 appliance is running with version 9.7.1-066. Do I need to upgrade to next version?

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170920-esa

When I check for upgrades available for our appliance, then it is showing below versions:

9.7.2-131

9.7.2-065

11.0.0-264

11.0.0-105

10.0.0-203

[Ken Stieers]

If you want to be protected from this specific vulnerability, you need do need to upgrade.

[Libin Varghese]

Hi,

The link provided has a defect ID which can be used to view the affected and fixed releases.

The link also has a table of fixed and affected releases in it.

Cisco AsyncOS ESA Software Major Release	First Fixed Release for This Vulnerability
Prior to 8.5	Not Vulnerable
8.5	Not Vulnerable
9.0	Affected; migrate to 9.8.1 or 10.0.2-20 or later
9.1	Affected; migrate to 9.8.1 or 10.0.2-20 or later
9.5	Affected; migrate to 9.8.1 or 10.0.2-20 or later
9.6	Affected; migrate to 9.8.1 or 10.0.2-20 or later
9.7	Affected; migrate to 9.8.1 or 10.0.2-20 or later
9.8	9.8.1
10.0	10.0.2-020
11.0	Not Vulnerable

Regards,

Libin Varghese

[pbabu6001]

C670 is not showing 9.8.1 version.

When I check for upgrades available for our appliance, then it is showing below versions only:

9.7.2-131

9.7.2-065

11.0.0-264

11.0.0-105

10.0.0-203

[Libin Varghese]

Async OS 9.8 is a FIPS release for goverment organizations who require Async OS with specific certifications.

For other customers you should upgrade to other available releases.

Release notes for all versions are available at:

https://www.cisco.com/c/en/us/support/security/email-security-appliance/products-release-notes-list.html

Note: You cannot upgrade from 9.8.0.x version to10.0.x release.

[pbabu6001]

Our C670 IronPorts running with 9.7 version and I can upgrade it to 10.0 version. But, the problem is CPU usage or performance of the IronPort. Currently, the CPU utilization is above 80%. 

Could you please suggest me basing on performance after upgraded to 10.0 version?

[Libin Varghese]

You could start by looking at the System Capacity report under Monitor tab to see if the CPU is high due to load on the appliance at that time.

The command "status detail" should also give you a direction on that.

If the CPU is consistently high and you do not see the device under heavy load as per the reports I would recommend opening a TAC case to get that checked.

Regards,

Libin Varghese