Trend Micro ServerProtect for Linux Multiple Cross Site Request Forgery Vulnerabilities
BID:98629
Info
Trend Micro ServerProtect for Linux Multiple Cross Site Request Forgery Vulnerabilities
| Bugtraq ID: | 98629 |
| Class: | Input Validation Error |
| CVE: |
CVE-2017-9033 |
| Remote: | Yes |
| Local: | No |
| Published: | May 23 2017 12:00AM |
| Updated: | May 23 2017 12:00AM |
| Credit: | Leandro Barragan and Maximiliano Vidal from Core Security Consulting Services |
| Vulnerable: |
Trend Micro ServerProtect for Linux 3.0 |
| Not Vulnerable: |
Trend Micro ServerProtect for Linux 3.0 CP 1531 |
Discussion
Trend Micro ServerProtect for Linux Multiple Cross Site Request Forgery Vulnerabilities
Trend Micro ServerProtect for Linux is prone to multiple cross-site request-forgery vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Exploiting these issues may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks.
ServerProtect for Linux 3.0 is vulnerable.
Trend Micro ServerProtect for Linux is prone to multiple cross-site request-forgery vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Exploiting these issues may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks.
ServerProtect for Linux 3.0 is vulnerable.
Exploit / POC
Trend Micro ServerProtect for Linux Multiple Cross Site Request Forgery Vulnerabilities
To exploit this issue an attacker must entice an unsuspecting victim to follow a malicious URI.
Core Security Technologies has created a proof-of-concept to demonstrate these issues. Please see the references for more information.
To exploit this issue an attacker must entice an unsuspecting victim to follow a malicious URI.
Core Security Technologies has created a proof-of-concept to demonstrate these issues. Please see the references for more information.
Solution / Fix
Trend Micro ServerProtect for Linux Multiple Cross Site Request Forgery Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.