Trend Micro Deep Discovery Director CVE-2017-11381 Command Injection Vulnerability

Bugtraq ID:	100318
Class:	Input Validation Error
CVE:	CVE-2017-11381
Remote:	Yes
Local:	No
Published:	Aug 01 2017 12:00AM
Updated:	Aug 01 2017 12:00AM
Credit:	Maximiliano Vidal from Core Security Consulting Services.
Vulnerable:	Trend Micro Deep Discovery Director 1.1
Not Vulnerable:	Trend Micro Deep Discovery Director 1.1 (Build 1249)

Trend Micro Deep Discovery Director CVE-2017-11381 Command Injection Vulnerability

Trend Micro Deep Discovery Director is prone to a command-injection vulnerability because it fails to properly sanitize user-supplied input.

Successfully exploiting this issue may allow an attacker to execute arbitrary code in the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

Trend Micro Deep Discovery Director CVE-2017-11381 Command Injection Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Trend Micro Deep Discovery Director CVE-2017-11381 Command Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Trend Micro Deep Discovery Director CVE-2017-11381 Command Injection Vulnerability

References:

• CORE-2017-0005: Trend Micro Deep Discovery Director Multiple Vulnerabilities (Core Security)
  
• Trend Micro Homepage (Trend Micro)
  
• SECURITY BULLETIN: Trend Micro Deep Discovery Director 1.1 Multiple Vulnerabilit (Trend Micro)