|
|
|||
| Rule General Information |
|---|
| Release Date: | 2016-12-27 | |
| Rule Name: | Trend Micro Smart Protection Server Admin_notification.php Command Injection Vulnerability -2 (CVE-2016-6267) | |
| Severity: | ||
| CVE ID: | ||
| CNNVD ID: | ||
| Rule Protection Details |
|---|
| Description: | SnmpUtils in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) spare_Community, (2) spare_AllowGroupIP, or (3) spare_AllowGroupNetmask parameter to admin_notification.php. | |
| Impact: | An attacker can execute arbitrary command via a successful exploit in the context of the vulnerable software. | |
| Affected OS: | Windows, Other Unix, FreeBSD, Linux | |
| Reference: | https://qkaiser.github.io/pentesting/trendmicro/2016/08/08/trendmicro-sps/ https://success.trendmicro.com/solution/1114913 |
|
| Solutions |
|---|
| More advisories have been published on the website, please visit for more suggestions: https://success.trendmicro.com/solution/1114913 |