CVE-2017-9034
CriticalSummary
Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to write to arbitrary files and consequently execute arbitrary code with root privileges due to failure to validate software updates.
Risk Assessment
The organization may be exposed to unauthorized code execution, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to update Trend Micro ServerProtect to the latest version to mitigate this vulnerability and implement appropriate software update validation mechanisms.
Other vulnerabilities in Trend Micro ServerProtect for Linux 3.0
See all- CVE-2017-9036High
Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows local users to gain privileges by leveraging an unrestricted quarantine directory.
- CVE-2017-9035High
Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to eavesdrop and tamper with updates by leveraging unencrypted communications with update servers.
- CVE-2017-9033High
CSRF vulnerability in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows remote attackers to hijack user authentication for requests to start an update from an arbitrary source via a crafted request.
Original NVD description (English source)
Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to write to arbitrary files and consequently execute arbitrary code with root privileges by leveraging failure to validate software updates.