Trend Micro InterScan Web Security Virtual Appliance Multiple Vulnerabilities

Bugtraq ID:	41072
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 14 2010 12:00AM
Updated:	Jun 23 2010 03:38PM
Credit:	Ivan Huertas
Vulnerable:	Trend Micro InterScan Web Security Virtual Appliance 0
Not Vulnerable:	Trend Micro InterScan Web Security Virtual Appliance Patch 1386

Trend Micro InterScan Web Security Virtual Appliance Multiple Vulnerabilities

Trend Micro InterScan Web Security Virtual Appliance is prone to multiple vulnerabilities.

Exploiting these issues can allow an attacker to download or upload arbitrary files to the system. This may aid in further attacks.

Firmware versions prior to Trend Micro InterScan Web Security Virtual Appliance Critical Build 1386 are vulnerable.

Trend Micro InterScan Web Security Virtual Appliance Multiple Vulnerabilities

Attackers can use readily available tools and commands to exploit these issues.

The following examples are available:

• /data/vulnerabilities/exploits/41072-upload.txt
• /data/vulnerabilities/exploits/41072-download.txt

Trend Micro InterScan Web Security Virtual Appliance Multiple Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

Trend Micro InterScan Web Security Virtual Appliance Multiple Vulnerabilities

References:

• CYBSEC Advisory#2010-0604 InterScan Web Security 5.0 Local Privilege Escalation (CYBSEC)
  
• CYBSEC Advisory#2010-0605 InterScan Web Security 5.0 Arbitrary File Upload (CYBSEC)
  
• CYBSEC Advisory#2010-0606 InterScan Web Security 5.0 Arbitrary File Download (CYBSEC)
  
• Trend Micro Homepage (Trend Micro)
  
• InterScan(TM) Web Security Virtual Appliance 5.0 Critical Patch - Build 1386 (Trend Micro)