Cisco Secure Web Appliance DVS Engine Anti-Malware Bypass Vulnerability

A vulnerability exists in the Dynamic Vectoring and Streaming (DVS) Engine of Cisco AsyncOS for Cisco Secure Web Appliance. It allows an unauthenticated, remote attacker to bypass the anti-malware scanner, enabling the download of malicious archive files. This issue arises from improper handling of certain archive files. Exploitation involves sending a crafted archive file, which should be blocked, through an affected device. Once downloaded, the malware would not execute automatically unless the end user extracted and opened the file.

Impact

Exploitation of this vulnerability could lead to the bypassing of the anti-malware scanner, allowing malware to be downloaded onto an end user workstation. The downloaded malware would require manual extraction and execution to activate.

Remediation

Users are advised to upgrade to Cisco AsyncOS for Cisco Secure Web Appliance version 15.2.5-011. Instructions for upgrading via the web interface are available in the Cisco Security Advisory.