CVE-2017-11392 - Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations

Back Back to CVE browser

HIGH

Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations

Published Aug 3, 2017

8.8

HIGH

CVSS 3.0

EPSS 34.09%

Description

Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the "T" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4745.

Affected products

Vendor Trend Micro Product Trend Micro InterScan Messaging Security Virtual Appliance Default
n/a
- Version
  9.0,9.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Trend Micro

Trend Micro InterScan Messaging Security Virtual Appliance

n/a

Version	Status	Constraints
9.0,9.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-77

References (4)

http://www.securityfocus.com/bid/100075
vdb-entryx_refsource_BID
http://www.zerodayinitiative.com/advisories/ZDI-17-504
x_refsource_MISCThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-3019
Advisory
https://success.trendmicro.com/solution/1117723
x_refsource_MISCVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/100075		vdb-entryx_refsource_BID
http://www.zerodayinitiative.com/advisories/ZDI-17-504		x_refsource_MISCThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-3019		Advisory
https://success.trendmicro.com/solution/1117723		x_refsource_MISCVendor Advisory