Trend Micro Email Encryption Gateway CVE-2018-6220 Remote Command Execution Vulnerability

Bugtraq ID:	103450
Class:	Input Validation Error
CVE:	CVE-2018-6220
Remote:	Yes
Local:	No
Published:	Feb 21 2018 12:00AM
Updated:	Feb 21 2018 12:00AM
Credit:	Leandro Barragan and Maximilian Vidal for Core Security Consulting and Vahagn Vardanyan.
Vulnerable:	Trend Micro Email Encryption Gateway 5.5 build 1111 Trend Micro Email Encryption Gateway 5.5 build 1107 Trend Micro Email Encryption Gateway 5.5 build 1073
Not Vulnerable:	Trend Micro Email Encryption Gateway 5.5 build 1129

Trend Micro Email Encryption Gateway CVE-2018-6220 Remote Command Execution Vulnerability

Trend Micro Email Encryption Gateway is prone to a remote command-injection vulnerability

Successfully exploiting this issue may allow an attacker to execute arbitrary code in the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

Trend Micro Email Encryption Gateway 5.5 Build 1111 and prior versions are vulnerable.

Trend Micro Email Encryption Gateway CVE-2018-6220 Remote Command Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Trend Micro Email Encryption Gateway CVE-2018-6220 Remote Command Execution Vulnerability

References:

• Trend Micro Homepage (Trend Micro)
  
• SECURITY BULLETIN: Trend Micro Email Encryption Gateway 5.5 Multiple Vulnerabili (Trend Micro)
  
• Trend Micro Email Encryption Gateway Multiple Vulnerabilities (coresecurity)