CVE-2017-14085: Infoleak
First published: Thu Oct 05 2017(Updated: )
Information disclosure vulnerabilities in Trend Micro OfficeScan 11.0 and XG may allow unauthenticated users who can access the OfficeScan server to query the network's NT domain or the PHP version and modules.
Credit: security@trendmicro.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Trend Micro OfficeScan | =11.0-sp1 | |
| Trend Micro OfficeScan | =12.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://hyp3rlinx.altervista.org/advisories/CVE-2017-14085-TRENDMICRO-OFFICESCAN-XG-REMOTE-NT-DOMAIN-PHP-INFO-DISCLOSURE.txt
- http://packetstormsecurity.com/files/144402/TrendMicro-OfficeScan-11.0-XG-12.0-Information-Disclosure.html
- http://seclists.org/fulldisclosure/2017/Sep/85
- http://www.securityfocus.com/archive/1/541281/100/0/threaded
- http://www.securityfocus.com/bid/101076
- http://www.securitytracker.com/id/1039500
- https://success.trendmicro.com/solution/1118372
- https://www.exploit-db.com/exploits/42893/
Frequently Asked Questions
What is the severity of CVE-2017-14085?
CVE-2017-14085 is classified as a medium severity vulnerability that can lead to information disclosure.
How do I fix CVE-2017-14085?
To fix CVE-2017-14085, ensure that your Trend Micro OfficeScan is updated to the latest version and apply any available patches.
What types of information can be disclosed in CVE-2017-14085?
CVE-2017-14085 allows unauthenticated users to access the NT domain information and details about the PHP version and modules.
Who is affected by CVE-2017-14085?
CVE-2017-14085 affects users of Trend Micro OfficeScan versions 11.0 SP1 and 12.0.
Is CVE-2017-14085 exploitable by remote attackers?
Yes, CVE-2017-14085 can be exploited by unauthenticated remote users who have access to the OfficeScan server.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/remedy
- agent/author
- agent/event
- agent/first-publish-date
- agent/description
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/trendmicro
- canonical/trend micro officescan
- version/trend micro officescan/11.0-sp1
- version/trend micro officescan/12.0