CVE-2016-6267: Input Validation
SnmpUtils in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) spareCommunity, (2) spareAllowGroupIP, or (3) spareAllowGroupNetmask parameter to adminnotification.php.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6267?
CVE-2016-6267 is classified with a medium severity level due to its potential for remote command execution.
How do I fix CVE-2016-6267?
To mitigate CVE-2016-6267, upgrade Trend Micro Smart Protection Server to build 2200 or later for version 2.5, build 2106 or later for version 2.6, or build 1330 or later for version 3.0.
Who is affected by CVE-2016-6267?
CVE-2016-6267 affects users of Trend Micro Smart Protection Server versions 2.5, 2.6, and 3.0 prior to their respective patched builds.
What types of attacks can exploit CVE-2016-6267?
CVE-2016-6267 can be exploited by authenticated remote users to execute arbitrary commands through crafted input.
Is there a workaround for CVE-2016-6267?
While the recommended approach is to update to a patched version, restricting access to the affected parameters can serve as a temporary workaround for CVE-2016-6267.