Trend Micro Threat Discovery Appliance CVE-2016-8585 Command Injection Vulnerability

Bugtraq ID:	98342
Class:	Unknown
CVE:	CVE-2016-8585
Remote:	Yes
Local:	No
Published:	May 09 2017 12:00AM
Updated:	May 23 2017 04:23PM
Credit:	Steven Seeley of Source Incite & Roberto Suggi Liverani.
Vulnerable:	Trend Micro Threat Discovery Appliance 2.6.1062r1
Not Vulnerable:

Trend Micro Threat Discovery Appliance CVE-2016-8585 Command Injection Vulnerability

Trend Micro Threat Discovery Appliance is prone to a remote command-injection vulnerability.

Successfully exploiting this issue may allow an attacker to execute arbitrary code in the context of the affected application. Failed exploit attempts may cause a denial-of-service condition.

Trend Micro Threat Discovery Appliance versions 2.6.1062r1 and prior are vulnerable.

Trend Micro Threat Discovery Appliance CVE-2016-8585 Command Injection Vulnerability

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

Trend Micro Threat Discovery Appliance CVE-2016-8585 Command Injection Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Trend Micro Threat Discovery Appliance CVE-2016-8585 Command Injection Vulnerability

References:

• Trend Micro Homepage (Trend Micro)
  
• poc.py (Github)