Views:

Trend Micro Proactive Protection and Solutions

As with any vulnerability, Trend Micro highly recommends that users apply all critical patches and fixes that vendors provide for security issues as soon as possible. These patches will provide the strongest level of defense against any potential attacks.

Fortunately, Trend Micro has analyzed the information to see if proactive protection rules and filters may be created to help protect against potential attacks, and has deployed the following:

ProductProtection TypeIdentifier
Deep SecurityIntrusion Prevention Rule1
  • 1009265 - Apache Struts OGNL Expression Remote Command Execution Vulnerability (CVE-2018-11776)
  • 1008610 - Block Object-Graph Navigation Language (OGNL) Expressions Initiation In Apache Struts HTTP Request
TippingPointDV Toolkit CSW Filter1
  • Filter C1000001: HTTP: OGNL Entity Usage in an HTTP URI
Deep Discovery InspectorDDI Rule and Patterns
  • 2726 - CVE-2018-11776 - APACHE STRUTS RCE EXPLOIT - HTTP(Request)
  • NCCP Pattern: 1.13387.00
  • NCIP Pattern: 1.134221.00
Cloud EdgeTrend Micro DPI Turnkey Solution
  • 1055434 - WEB Apache Struts 2 OGNL Script Injection -3
  • 1055457 - WEB Apache Struts 2 OGNL Script Injection -5
Anti-Malware  ProductsVSAPI Pattern
  • TBD if needed for specific threats
Anti-Spware ProductsSpyware (SSAPI) Pattern
  • TBD if needed for specific threats

1 Due to the nature of the Deep Security rules and TippingPoint filters, certain environments may experience false positives. Customers are advised to review triggers in their networks and put the rules/filters in prevent mode if necessary.

Some rules in Deep Security may not be enabled by default and should be enabled manually after the rule has been tested in your environment.

In addition, by default, all filters in the DV Toolkit (DVT) are not enabled and have no recommendation action set.  More information on deploying DVT packages can be found here or by contacting Trend Micro TippingPoint Technical Assistance Center (TAC) with additional questions.

Trend Micro Affected Products

Due to the popularity and prevalence of Apache Struts, Trend Micro analyzed its own product set to see if any products may be using affected versions and would be affected by this vulnerability.  

Trend Micro has confirmed that no Trend Micro products are affected by this vulnerability.

Affected Products

  • None
Non-Affected Products
  • All Trend Micro products

Reference(s)