full-disclosure - [FD] SSD Advisory – Trend Micro Deep Security Multiple Vulnerabilities

Open Source and information security mailing list archives

Message-ID: <CAAnZqX-ij_HdETTNpx5e50h6BwYSKQ+2+fTBQMfSsHUO8wHN+w@mail.gmail.com>
Date: Mon, 29 May 2017 13:21:21 +0300
From: Maor Shwartz <maors@...ondsecurity.com>
To: fulldisclosure@...lists.org
Subject: [FD] SSD Advisory – Trend Micro Deep Security Multiple Vulnerabilities

Link: https://blogs.securiteam.com/index.php/archives/3050

*Vulnerabilities Summary*
The following advisory describes three (3) vulnerabilities found in Trend
Micro Deep Security version 6.5.

“The Trend Micro Hybrid Cloud Security solution, powered by XGen security,
delivers a blend of cross-generational threat defense techniques that have
been optimized to protect physical, virtual, and cloud workloads. It
features Trend Micro Deep Security, the market share leader in server
security, protecting millions of physical, virtual, and cloud servers
around the world.

Deep Security offers multiple layers of security that protect your servers
as they move—across the data center, into the cloud, or in a hybrid
deployment.”

The vulnerabilities found in Trend Micro Deep Security:

XML External Entity (XXE) that lead to arbitrary file disclosure
Local Privilege Escalation
Remote code execution

*Credit*
An independent security researcher has reported this vulnerability to
Beyond Security’s SecuriTeam Secure Disclosure program.

*Vendor response*
Trend Micro has released patches to address these vulnerabilities and
issued the following advisory:
https://success.trendmicro.com/solution/1117412

--
Thanks
Maor Shwartz
GPG Key ID: 93CC36E2DE7FF514

Download attachment "SSD Advisory – Trend Micro Deep Security Multiple Vulnerabilities – SecuriTeam Blogs.pdf" of type "application/pdf" (117847 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives