Trend Micro ScanMail for Exchange CVE-2017-14090 Security Bypass Vulnerability

Bugtraq ID:	102244
Class:	Input Validation Error
CVE:	CVE-2017-14090
Remote:	Yes
Local:	No
Published:	Oct 26 2017 12:00AM
Updated:	Oct 26 2017 12:00AM
Credit:	Leandro Barragan and Maximilian Vidal for Core Security Consulting
Vulnerable:	Trend Micro ScanMail for Microsoft Exchange 12.0
Not Vulnerable:	Trend Micro ScanMail for Microsoft Exchange 12.0 SP1 Patch 1 CP1755

Trend Micro ScanMail for Exchange CVE-2017-14090 Security Bypass Vulnerability

Trend Micro ScanMail for Exchange is prone to a security-bypass vulnerability.

Successfully exploiting this issue may allow attackers to bypass certain security restrictions and perform unauthorized actions by conducting a man-in-the-middle attack. This may lead to other attacks.

ScanMail for Exchange 12.0 is vulnerable.

Trend Micro ScanMail for Exchange CVE-2017-14090 Security Bypass Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Trend Micro ScanMail for Exchange CVE-2017-14090 Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Trend Micro ScanMail for Exchange CVE-2017-14090 Security Bypass Vulnerability

References:

• Trend Micro Homepage (Trend Micro)
  
• coresecurity advisory (coresecurity)
  
• trendmicro advisory (trendmicro)