CVE-2017-9035
HighSummary
Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to eavesdrop and tamper with updates by leveraging unencrypted communications with update servers.
Risk Assessment
The organization is at risk of having updates intercepted, potentially leading to the introduction of malware or other unauthorized changes to the system.
Recommendation
It is recommended to upgrade to the latest version of the software that ensures encrypted communication with update servers.
Other vulnerabilities in Trend Micro ServerProtect for Linux 3.0
See all- CVE-2017-9036High
Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows local users to gain privileges by leveraging an unrestricted quarantine directory.
- CVE-2017-9033High
CSRF vulnerability in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows remote attackers to hijack user authentication for requests to start an update from an arbitrary source via a crafted request.
- CVE-2017-9034Critical
Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to write to arbitrary files and consequently execute arbitrary code with root privileges due to failure to validate software updates.
Original NVD description (English source)
Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to eavesdrop and tamper with updates by leveraging unencrypted communications with update servers.