SB2017080116 - Multiple vulnerabilities in Deep Discovery Director

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Insufficient verification of data authenticity (CVE-ID: CVE-2017-11379)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Configuration and database backup archives are not signed or validated in Trend Micro Deep Discovery Director 1.1.

2) Use of hard-coded credentials (CVE-ID: CVE-2017-11380)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Backup archives were found to be encrypted with a static password across different installations, which suggest the same password may be used in all virtual appliance instances of Trend Micro Deep Discovery Director 1.1.

3) OS Command Injection (CVE-ID: CVE-2017-11381)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

A command injection vulnerability exists in Trend Micro Deep Discovery Director 1.1 that allows an attacker to restore accounts that can access the pre-configuration console.

Remediation

Install update from vendor's website.

References

• https://success.trendmicro.com/solution/1117663
• https://www.coresecurity.com/advisories/trend-micro-deep-discovery-director-multiple-vulnerabilities