====================================================================

                              CERT-Renater

                 Note d'Information No. 2017/VULN167
_____________________________________________________________________

DATE                : 01/06/2017

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S):  Cisco Firepower System Software.

=====================================================================
https://success.trendmicro.com/solution/1117412
____________________________________________________________________

SECURITY BULLETIN: Trend Micro InterScan Web Security Virtual Appliance
6.5 Multiple Vulnerabilities

        Updated: 27 May 2017
        Product/Version: InterScan Web Security Virtual Appliance 6.5
        Platform: Appliance All


Summary

Release Date: May 22, 2017
Trend Micro Vulnerability Identifier(s): VRTS-325, 327
Platform(s): Virtual Appliance
CVSS 3.0 Score(s): 4.5
Severity Rating(s): Medium

Trend Micro has released a new hot fix for Trend Micro InterScan Web
Security Virtual Appliance (IWSVA) 6.5. This build resolves multiple
vulnerabilities related to potential remote code execution.


Details

Affected Version(s)

Product	Affected Version(s)	Platform	Language(s)
IWSVA	Version 6.5	Virtual Appliance	English


Solution

Trend Micro has released the following solutions to address the issue:

Product	Updated version	Notes	Platform	Availability
IWSVA	Version 6.5 SP2 HF 1755*  Readme  Virtual Appliance   Now

* Version 6.5 SP2 HF 1755 requires at least Version 6.5 SP2 Patch 1
(build 1707)  as a prerequisite and both are required to fully
remediate the vulnerabilities covered in this bulletin.  In addition,
HF 1755 is the minimum build number required for coverage - customers
who have been given HF's with higher build numbers than 1755 for other
specific issues are already covered.

Customers are encouraged to visit Trend Micro’s Download Center to
obtain prerequisite software (such as Service Packs) before applying
any of the solutions above.


Vulnerability Details

This update resolves multiple vulnerabilities in Trend Micro InterScan
Web Security Virtual Appliance 6.5 in where are issues with the web
service inspection of input parameters that could potentially be
exploited to implement remote code injections.

Please note that exploitation of this vulnerability requires the
attacker to have already obtained access to admin rights via some other
method.

Due to the seriousness of these vulnerabilities, customers are highly
encouraged to update to the latest build as soon as possible.


Mitigating Factors

Exploiting these type of vulnerabilities generally require that an
attacker has access (physical or remote) to a vulnerable machine. In
addition to timely application of patches and updated solutions,
customers are also advised to review remote access to critical systems
and ensure policies and perimeter security is up-to-date.

However, even though an exploit may require several specific conditions
to be met, Trend Micro strongly encourages customers to update to the
latest builds as soon as possible.


Acknowledgement

Trend Micro would like to thank the following individuals for
responsibly disclosing these issues and working with Trend Micro to
help protect our customers:

    SSD of Beyond Security



==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================