[Vulnerability Confirmation] Susceptibility of system password to be uncovered by attackers of Threat Intelligence Manager (TIM)

- Updated:
- 24 Nov 2016
- Product/Version:
- Threat Intelligence Manager 1.0
- Platform:
- Windows 2008 Datacenter 64-bit
- Windows 2008 Enterprise 64-bit
- Windows 2008 Standard 64-bit
- Windows 2008 Web Server Edition 64-bit

Summary

Trend Micro has been notified of a product vulnerability in TIM.

According to the report, certain files/scripts present in TIM's web interface are vulnerable to arbitrary file reading. In addition, the password of the "admin" account is written in plain text in one of the installation log files.

These vulnerabilities indicate that the system password may be more easily uncovered by attackers, and would then allow them to remotely control TIM.

Details

Trend Micro has released TIM 1.0 Patch 5 to address this vulnerability.

After installing the patch, the vulnerable files will be removed and/or replaced with updated, non-vulnerable versions.

The patch installer may be downloaded from Trend Micro Download Center.

Rating:

Category:

Troubleshoot

Solution Id:

1103000

Feedback

Did this article help you?

Thank you for your feedback!

What was the problem with this article?

The image(s) in the article did not display properly.

The article did not provide detailed procedure.

The article is hard to understand and follow.

The video did not play properly.

The article did not resolve my issue.

Others. Please specify.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support

Thanks for voting.

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:

We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.