Trend Micro InterScan Messaging Security Multiple Command Injection Vulnerabilities

Bugtraq ID:	100075
Class:	Unknown
CVE:	CVE-2017-11391 CVE-2017-11392
Remote:	Yes
Local:	No
Published:	Jul 31 2017 12:00AM
Updated:	Jul 31 2017 12:00AM
Credit:	Steven Seeley (mr_me) of Offensive Security.
Vulnerable:	Trend Micro InterScan Messaging Security Virtual Appliance 9.1 Trend Micro InterScan Messaging Security Virtual Appliance 9.0
Not Vulnerable:

Trend Micro InterScan Messaging Security Multiple Command Injection Vulnerabilities

Trend Micro InterScan Messaging Security is prone to multiple command-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Exploiting these issues could allow an attacker to execute arbitrary commands in context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

Trend Micro InterScan Messaging Security Multiple Command Injection Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Trend Micro InterScan Messaging Security Multiple Command Injection Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.