PT-2017-13236 · Trend Micro · Trend Micro Mobile Security

Malerisch + 3 · Published 2017-09-15 · Updated 2017-09-29 · CVE-2017-14079

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trend Micro Mobile Security (Enterprise) versions prior to 9.7 Patch 3

Description The issue allows remote attackers to execute arbitrary code on vulnerable installations due to unrestricted file uploads. This can be achieved through various file upload functions, including upload img file, upload font file, upload wallpaper file, and upload app file.

Recommendations For versions prior to 9.7 Patch 3, update to version 9.7 Patch 3 or later to resolve the issue. As a temporary workaround, consider restricting or disabling the file upload functionality until a patch is applied. Specifically, restrict access to the upload img file, upload font file, upload wallpaper file, and upload app file functions to minimize the risk of exploitation.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2017-14079

ZDI-17-785

ZDI-17-789

ZDI-17-790

ZDI-17-807

Affected Products

Trend Micro Mobile Security

References · 12

• https://success.trendmicro.com/solution/1118224 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-14079 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-17-790 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-17-785 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-17-789 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-17-807 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-14079 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-17-790 · Note
• http://zerodayinitiative.com/advisories/ZDI-17-789 · Note
• http://securityfocus.com/bid/100970 · Note
• http://zerodayinitiative.com/advisories/ZDI-17-785 · Note
• http://zerodayinitiative.com/advisories/ZDI-17-807 · Note