SB2017080116 - Multiple vulnerabilities in Deep Discovery Director

Description

This security bulletin contains information about 3 vulnerabilities.

1) Insufficient verification of data authenticity (CVE-ID: CVE-2017-11379)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Configuration and database backup archives are not signed or validated in Trend Micro Deep Discovery Director 1.1.

2) Use of hard-coded credentials (CVE-ID: CVE-2017-11380)

CWE-ID: CWE-798 - Use of Hard-coded Credentials

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Backup archives were found to be encrypted with a static password across different installations, which suggest the same password may be used in all virtual appliance instances of Trend Micro Deep Discovery Director 1.1.

3) OS Command Injection (CVE-ID: CVE-2017-11381)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

A command injection vulnerability exists in Trend Micro Deep Discovery Director 1.1 that allows an attacker to restore accounts that can access the pre-configuration console.

Remediation

Install update from vendor's website.

References

• https://success.trendmicro.com/solution/1117663
• https://www.coresecurity.com/advisories/trend-micro-deep-discovery-director-multiple-vulnerabilities