CVE Vulnerability Identifier(s): CVE-2017-14083 through 14089
Platform(s): Windows
CVSS 2.0 Score(s): 6.9 (ZDI)
CVSS 3.0 Score(s): 4.1 - 6.5 (Others)
Severity Rating(s): Medium
Trend Micro has released Critical Patches (CPs) for Trend Micro OfficeScan versions 11.0 SP1 and XG (12.). These CPs resolve multiple vulnerabilities that could potentially allow a remote attacker to execute arbitrary code on vulnerable installations.
Affected Version(s)
| Product | Affected Version(s) | Platform | Language(s) |
|---|---|---|---|
| OfficeScan | XG (12.0) | Windows | English |
| 11.0 SP1 | Windows | English |
Solution
Trend Micro has released the following solutions to address the issue:
| Product | Updated version | Notes | Platform | Availability |
|---|---|---|---|---|
| OfficeScan | XG (12.0) CP 1708 | Readme | Windows | Now |
| 11.0 SP1 CP 6426 | Readme | Windows | Now |
Customers are encouraged to visit Trend Micro’s Download Center to obtain prerequisite software (such as Service Packs and other patches) before applying any of the solutions above.
Vulnerability Details
These CPs resolve multiple vulnerabilities in Trend Micro OfficeScan 11.0 and XG (12.0)* in which a remote attacker could potentially attain code execution on vulnerable installations:
- Pre-authorization Start Remote Process
- Information Disclosure
- Host Header Injection
- Unauthenticated Access Control
- Man-in-the-Middle (MITM) Remote Code Execution
- Memory Corruption Privilege Escalation
Due to the nature of any vulnerability, customers are highly encouraged to update to the latest build or patch as soon as possible.
*Please note that not all vulnerabilities listed above apply to both OfficeScan 11 and XG, however, it is strongly recommended that the CPs are applied to both versions to resolve any and all potential issues.
Mitigating Factors
Exploiting these type of vulnerabilities generally require that an attacker has access (physical or remote) to a vulnerable machine. In addition to timely application of patches and updated solutions, customers are also advised to review remote access to critical systems and ensure policies and perimeter security is up-to-date.
However, even though an exploit may require several specific conditions to be met, Trend Micro strongly encourages customers to update to the latest builds as soon as possible.
Acknowledgement
Trend Micro would like to thank the following individuals for responsibly disclosing these issues and working with Trend Micro to help protect our customers:
- John Page (aka hyp3rlinx) of ApparitionSec
- Leong Wai Meng
- zer0b4by working with Trend Micro's Zero Day Initiative
External Reference(s)
The following advisories may be found by visiting the following sites:
CVEs - https://cve.mitre.org/cve/cve.html
ZDI Adivsories - Trend Micro's Zero Day Initiative Published Advisories
| CVE | ZDI Case(s) |
| CVE-2017-14083 | |
| CVE-2017-14084 | |
| CVE-2017-14085 | |
| CVE-2017-14086 | |
| CVE-2017-14087 | |
| CVE-2017-14088 | ZDI-17-828, ZDI-17-829 |
| CVE-2017-14089 |
