CVE-2017-6398: OS Command Injection
An issue was discovered in Trend Micro InterScan Messaging Security (Virtual Appliance) 9.1-1600. An authenticated user can execute a terminal command in the context of the web server user (which is root). Besides, the default installation of IMSVA comes with default administrator credentials. The saveCert.imss endpoint takes several user inputs and performs blacklisting. After that, it uses them as arguments to a predefined operating-system command without proper sanitization. However, because of an improper blacklisting rule, it's possible to inject arbitrary commands into it.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6398?
CVE-2017-6398 has been classified with a high severity rating due to its potential for authenticated users to execute arbitrary commands with root privileges.
How do I fix CVE-2017-6398?
To fix CVE-2017-6398, ensure that you update to the latest version of Trend Micro InterScan Messaging Security Virtual Appliance and change the default administrator credentials.
Who is affected by CVE-2017-6398?
CVE-2017-6398 affects users of Trend Micro InterScan Messaging Security Virtual Appliance version 9.1-1600.
What are the risks associated with CVE-2017-6398?
The risks associated with CVE-2017-6398 include unauthorized command execution and potential system compromise due to default credentials.
Is there a workaround for CVE-2017-6398?
A workable approach for CVE-2017-6398 is to manually change the default administrator credentials and restrict access to trusted users until a patch is applied.