CVE-2017-11383: SQL Injection

Published Aug 2, 2017

Updated

SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x1b07 due to lack of proper user input validation in cmdHandlerTVCSCommander.dll. Formerly ZDI-CAN-4560.

Affected Software

1 affected component

trendmicro Control Manager=6.0

Remediation

Patch Available

https://success.trendmicro.com/solution/1117722

Event History

Aug 2, 2017

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2017-11383?

CVE-2017-11383 is classified as a critical vulnerability due to its potential for Remote Code Execution.

How do I fix CVE-2017-11383?

To fix CVE-2017-11383, update Trend Micro Control Manager to the latest version and ensure proper user input validation is implemented.

What systems are affected by CVE-2017-11383?

CVE-2017-11383 specifically affects Trend Micro Control Manager version 6.0.

What are the potential impacts of CVE-2017-11383?

The potential impacts of CVE-2017-11383 include unauthorized access and execution of malicious code on the affected system.

Is there a workaround for CVE-2017-11383?

Currently, disabling services that utilize cmdHandlerTVCSCommander.dll can mitigate some risk associated with CVE-2017-11383, but updating is the preferred solution.