Trend Micro Deep Discovery Director Multiple Security Vulnerabilities
BID:99570
Info
Trend Micro Deep Discovery Director Multiple Security Vulnerabilities
| Bugtraq ID: | 99570 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 13 2017 12:00AM |
| Updated: | Jul 13 2017 12:00AM |
| Credit: | Maximiliano Vidal from Core Security Consulting Services. |
| Vulnerable: |
Trend Micro Deep Discovery Director 1.1 (Build 1241) |
| Not Vulnerable: |
Trend Micro Deep Discovery Director 1.1 (Build 1249) |
Discussion
Trend Micro Deep Discovery Director Multiple Security Vulnerabilities
Trend Micro Deep Discovery Director is prone to the following multiple security vulnerabilities:
1. A security bypass vulnerability.
2. A hard-coded password security bypass vulnerability.
3. A remote command-injection vulnerability.
An attacker may exploit these issues to gain access to sensitive information, bypass certain security restrictions and perform unauthorized actions, and execute arbitrary commands in context of the affected application. Failed exploit attempts will result in denial-of-service conditions.
Trend Micro Deep Discovery Director 1.1 (Build 1241) is vulnerable; other versions may also be affected.
Trend Micro Deep Discovery Director is prone to the following multiple security vulnerabilities:
1. A security bypass vulnerability.
2. A hard-coded password security bypass vulnerability.
3. A remote command-injection vulnerability.
An attacker may exploit these issues to gain access to sensitive information, bypass certain security restrictions and perform unauthorized actions, and execute arbitrary commands in context of the affected application. Failed exploit attempts will result in denial-of-service conditions.
Trend Micro Deep Discovery Director 1.1 (Build 1241) is vulnerable; other versions may also be affected.
Exploit / POC
Trend Micro Deep Discovery Director Multiple Security Vulnerabilities
The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.
The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.
Solution / Fix
Trend Micro Deep Discovery Director Multiple Security Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Trend Micro Deep Discovery Director Multiple Security Vulnerabilities
References:
References:
- CORE-2017-0005: Trend Micro Deep Discovery Director Multiple Vulnerabilities (Core Security)
- Trend Micro Homepage (Trend Micro)