PT-2015-5954 · Trend Micro · Trend Micro Deep Discovery Inspector

Hyp3Rlinx + 1 · Published 2015-08-23 · Updated 2021-09-09 · CVE-2015-2873

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Trend Micro Deep Discovery Inspector (DDI) versions prior to 3.5.1477 Trend Micro Deep Discovery Inspector (DDI) versions 3.6.x prior to 3.6.1217 Trend Micro Deep Discovery Inspector (DDI) versions 3.7.x prior to 3.7.1248 Trend Micro Deep Discovery Inspector (DDI) versions 3.8.x prior to 3.8.1263

Description The issue allows remote attackers to obtain sensitive information or change the configuration via a direct request to specific URLs, including the system log URL, whitelist URL, or blacklist URL.

Recommendations For versions prior to 3.5.1477, update to version 3.5.1477 or later. For versions 3.6.x prior to 3.6.1217, update to version 3.6.1217 or later. For versions 3.7.x prior to 3.7.1248, update to version 3.7.1248 or later. For versions 3.8.x prior to 3.8.1263, update to version 3.8.1263 or later.

Fix

Weakness Enumeration

CWE-425

Related Identifiers

CVE-2015-2873

Affected Products

Trend Micro Deep Discovery Inspector

References · 5

• http://esupport.trendmicro.com/solution/en-US/1112206.aspx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-2873 · Security Note
• http://securityfocus.com/bid/76396 · Note
• http://kb.cert.org/vuls/id/248692 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2873 · Note