PT-2017-10051 · Trend Micro · Trend Micro Interscan Web Security Virtual Appliance

Published 2017-02-21 · Updated 2017-07-25 · CVE-2016-9314

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Web Security Virtual Appliance (IWSVA) versions prior to 6.5 CP 1737

Description The issue allows authenticated, remote users with least privileges to backup the system configuration and download it onto their local machine, potentially exposing sensitive information like passwd/shadow files, RSA certificates, Private Keys, and Default Passphrase.

Recommendations For versions prior to 6.5 CP 1737, update to version 6.5 CP 1737 to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-9314

Affected Products

Trend Micro Interscan Web Security Virtual Appliance

References · 6

• 🔥 https://exploit-db.com/exploits/41361 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-9314 · Security Note
• https://success.trendmicro.com/solution/1116672 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-9314 · Vendor Advisory
• http://securityfocus.com/bid/96252 · Note
• http://securitytracker.com/id/1037849 · Note