PT-2017-3010 · Trend Micro · Officescan

Hyp3Rlinx + 1 · Published 2017-09-27 · Updated 2019-10-03 · CVE-2017-14086

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Trend Micro OfficeScan versions 11.0 and XG

Description The issue is related to resource management errors. It may allow a remote attacker with access to the OfficeScan server to execute the fcgiOfcDDA.exe executable or cause potential INI file corruption. This could lead to the consumption of server disk space with dump files from continuous HTTP requests.

Recommendations For Trend Micro OfficeScan versions 11.0 and XG, consider restricting access to the server to minimize the risk of exploitation. As a temporary workaround, consider disabling the execution of the fcgiOfcDDA.exe executable until a patch is available. Restrict access to the vulnerable INI files to prevent potential corruption. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-399

Related Identifiers

BDU:2017-02363

CVE-2017-14086

Affected Products

Officescan

References · 16

• 🔥 https://exploit-db.com/exploits/42892 · Exploit
• 🔥 http://hyp3rlinx.altervista.org/advisories/CVE-2017-14086-TRENDMICRO-OFFICESCAN-XG-PRE-AUTH-START-REMOTE-PROCESS-CODE-EXECUTION-MEM-CORRUPT.txt · Exploit
• https://success.trendmicro.com/solution/1118372 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14086 · Security Note
• https://bdu.fstec.ru/vul/2017-02363 · Security Note
• https://osv.dev/vulnerability/CVE-2017-14086 · Vendor Advisory
• http://packetstormsecurity.com/files/144464/TrendMicro-OfficeScan-11.0-XG-12.0-Memory-Corruption.html · Note
• http://securitytracker.com/id/1039500 · Note
• http://securityfocus.com/archive/1/archive/1/541271/100/0/threaded · Note
• https://exploit-db.com/exploits/42920 · Note
• http://securityfocus.com/bid/101076 · Note
• http://seclists.org/fulldisclosure/2017/Sep/88 · Note
• http://securityfocus.com/archive/1/541274/100/0/threaded · Note
• http://packetstormsecurity.com/files/144401/TrendMicro-OfficeScan-11.0-XG-12.0-Auth-Start-Code-Execution.html · Note
• http://seclists.org/fulldisclosure/2017/Sep/91 · Note