Trend Micro Smart Protection Server Multiple Security Vulnerabilities

Bugtraq ID:	102275
Class:	Input Validation Error
CVE:	CVE-2017-11398 CVE-2017-14094 CVE-2017-14095 CVE-2017-14096 CVE-2017-14097
Remote:	Yes
Local:	No
Published:	Dec 21 2017 12:00AM
Updated:	Dec 21 2017 12:00AM
Credit:	Leandro Barragan and Maximiliano Vidal from Core Security Consulting Services.
Vulnerable:	Trend Micro Smart Protection Server 3.2
Not Vulnerable:

Trend Micro Smart Protection Server Multiple Security Vulnerabilities

Trend Micro Smart Protection Server is prone to the following security vulnerabilities.

1. Session Hijacking Vulnerability
2. A command Execution Vulnerability
3. HTML-injection vulnerability
4. A local file-inclusion vulnerability

Attackers can exploit these issues to steal cookie-based authentication credentials, to execute arbitrary scripts in the context of the web browser, and to execute arbitrary commands.

Trend Micro Smart Protection Server Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Trend Micro Smart Protection Server Multiple Security Vulnerabilities

References:

• Trend Micro Homepage (Trend Micro)
  
• Trend Micro Smart Protection Server Multiple Vulnerabilities (CoreSecurity)