CVE-2017-6398: OS Command Injection
First published: Tue Mar 14 2017(Updated: )
An issue was discovered in Trend Micro InterScan Messaging Security (Virtual Appliance) 9.1-1600. An authenticated user can execute a terminal command in the context of the web server user (which is root). Besides, the default installation of IMSVA comes with default administrator credentials. The saveCert.imss endpoint takes several user inputs and performs blacklisting. After that, it uses them as arguments to a predefined operating-system command without proper sanitization. However, because of an improper blacklisting rule, it's possible to inject arbitrary commands into it.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Trend Micro InterScan Messaging Security Virtual Appliance | =9.1-1600 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-6398?
CVE-2017-6398 has been classified with a high severity rating due to its potential for authenticated users to execute arbitrary commands with root privileges.
How do I fix CVE-2017-6398?
To fix CVE-2017-6398, ensure that you update to the latest version of Trend Micro InterScan Messaging Security Virtual Appliance and change the default administrator credentials.
Who is affected by CVE-2017-6398?
CVE-2017-6398 affects users of Trend Micro InterScan Messaging Security Virtual Appliance version 9.1-1600.
What are the risks associated with CVE-2017-6398?
The risks associated with CVE-2017-6398 include unauthorized command execution and potential system compromise due to default credentials.
Is there a workaround for CVE-2017-6398?
A workable approach for CVE-2017-6398 is to manually change the default administrator credentials and restrict access to trusted users until a patch is applied.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/severity
- agent/weakness
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/trendmicro
- canonical/trend micro interscan messaging security virtual appliance
- version/trend micro interscan messaging security virtual appliance/9.1-1600