PT-2017-10036 · Trend Micro · Trend Micro Interscan Web Security Virtual Appliance

Published 2017-02-21 · Updated 2017-07-25 · CVE-2016-9269

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trend Micro Interscan Web Security Virtual Appliance (IWSVA) versions 6.5-SP2 Build Linux 1707 and earlier

Description The issue allows authenticated, remote users with least privileges to run arbitrary commands on the system as root via Patch Update functionality in the com.trend.iwss.gui.servlet.ManagePatches component.

Recommendations For versions 6.5-SP2 Build Linux 1707 and earlier, update to Version 6.5 CP 1737 to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2016-9269

Affected Products

Trend Micro Interscan Web Security Virtual Appliance

References · 6

• 🔥 https://exploit-db.com/exploits/41361 · Exploit
• https://success.trendmicro.com/solution/1116672 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9269 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9269 · Vendor Advisory
• http://securityfocus.com/bid/96252 · Note
• http://securitytracker.com/id/1037849 · Note