PT-2017-3096 · Trend Micro · Trend Micro Threat Discovery Appliance

Malerisch + 2 · Published 2017-04-10 · Updated 2017-04-17 · CVE-2016-7552

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trend Micro Threat Discovery Appliance version 2.6.1062r1

Description The issue allows a remote, unauthenticated attacker to delete arbitrary files as root due to directory traversal when processing a session id cookie. This can be used to bypass authentication or cause a denial of service. The vulnerability exists because of incorrect restriction of the directory path name with limited access during the processing of the session id parameter from the cookie file.

Recommendations For Trend Micro Threat Discovery Appliance version 2.6.1062r1, as a temporary workaround, consider restricting access to the session id cookie parameter until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2017-02474

CVE-2016-7552

Affected Products

Trend Micro Threat Discovery Appliance

References · 7

• 🔥 https://github.com/rapid7/metasploit-framework/pull/8216/commits/0f07875a2ddb0bfbb4e985ab074e9fc56da1dcf6 · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/trendmicro_threat_discovery_admin_sys_time_cmdi.rb · Exploit
• 🔥 https://gist.github.com/malerisch/5de8b408443ee9253b3954a62a8d97b4 · Exploit
• https://bdu.fstec.ru/vul/2017-02474 · Security Note
• https://osv.dev/vulnerability/CVE-2016-7552 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-7552 · Security Note
• http://securityfocus.com/bid/97599 · Note