Trend Micro Threat Discovery Appliance CVE-2016-8588 Command Injection Vulnerability

Bugtraq ID:	98433
Class:	Design Error
CVE:	CVE-2016-8588
Remote:	Yes
Local:	No
Published:	Apr 28 2017 12:00AM
Updated:	May 23 2017 04:25PM
Credit:	Steven Seeley of Source Incite & Roberto Suggi Liverani
Vulnerable:	Trend Micro Threat Discovery Appliance 2.6.1062r1
Not Vulnerable:

Trend Micro Threat Discovery Appliance CVE-2016-8588 Command Injection Vulnerability

Trend Micro Threat Discovery Appliance is prone to a remote command-injection vulnerability.

An attacker may exploit this issue to execute arbitrary code within the context of the application; this may aid in further attacks.

Trend Micro Threat Discovery Appliance 2.6.1062r1 is vulnerable; other versions may also be affected.

Trend Micro Threat Discovery Appliance CVE-2016-8588 Command Injection Vulnerability

The researcher has created a proof-of-concept code to demonstrate the issue. Please see the references for more information.

Trend Micro Threat Discovery Appliance CVE-2016-8588 Command Injection Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Trend Micro Threat Discovery Appliance CVE-2016-8588 Command Injection Vulnerability

References:

• Trend Micro Homepage (Trend Micro)
  
• CVE-2016-8588 - Trend Micro Threat Discovery Appliance <= 2.6.1062r1 hotfix_uplo (GitHub)