CVE-2017-6398 : An issue was discovered in Trend Micro InterScan Messaging Security (Virtual App

An issue was discovered in Trend Micro InterScan Messaging Security (Virtual Appliance) 9.1-1600. An authenticated user can execute a terminal command in the context of the web server user (which is root). Besides, the default installation of IMSVA comes with default administrator credentials. The saveCert.imss endpoint takes several user inputs and performs blacklisting. After that, it uses them as arguments to a predefined operating-system command without proper sanitization. However, because of an improper blacklisting rule, it's possible to inject arbitrary commands into it.

Published 2017-03-14 09:59:00

Updated 2019-10-03 00:03:26

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2017-6398

Trendmicro » Interscan Messaging Security Virtual Appliance » Version: 9.1-1600
cpe:2.3:a:trendmicro:interscan_messaging_security_virtual_appliance:9.1-1600:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2017-6398

EPSS FAQ

11.16%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 94 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2017-6398

Trend Micro InterScan Messaging Security (Virtual Appliance) Remote Code Execution

Disclosure Date: 2017-01-15

First seen: 2020-04-26

exploit/linux/http/trend_micro_imsva_exec

This module exploits a command injection vulnerability in the Trend Micro IMSVA product. An authenticated user can execute a terminal command under the context of the web server user which is root. Besides, default installation of IMSVA comes with a default administr

More information

CVSS scores for CVE-2017-6398

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.0	HIGH	AV:N/AC:L/Au:S/C:C/I:C/A:C	8.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
8.8	HIGH	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2017-6398

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-6398

https://www.rapid7.com/db/modules/exploit/linux/http/trend_micro_imsva_exec

Trend Micro InterScan Messaging Security (Virtual Appliance) Remote Code Execution | Rapid7
Third Party Advisory
http://www.securityfocus.com/bid/96859

Trend Micro InterScan Messaging Security CVE-2017-6398 Remote Code Execution Vulnerability

Jump to