检测

Trend Micro IWSVA 6.5 < 6.5 Build 1746 多个漏洞

medium Nessus 插件 ID 99248

语言：

简介

远程主机受到多个漏洞影响。

描述

远程主机上安装的 Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 版本为低于 6.5 Build 1746 的 6.5 版。因而会受到多个漏洞的影响：- 存在多个访问控制问题，允许低权限的经身份验证的远程攻击者修改 FTP 访问控制、创建或修改报告，或上传 HTTPS 解密凭证和私钥。(CVE-2017-6338) - 管理特定密钥和凭证数据的方式中有一个缺陷。默认 IWSVA 是私密凭证授权单位 (CA)，可动态产生发送至客户端浏览器的数字证书，以完成 HTTPS 连接的安全传递。允许管理员上传由 root CA 签署的自有凭证。低权限的经身份验证的远程攻击者可下载最新 CA 凭证和私钥（预设的凭证和私钥，或管理员上传的凭证和私钥），并用来解密 HTTPS 流量，进而导致机密性丧失。此外，设备上的默认私钥也是用极弱的密码加密。攻击者同样可恶意利用此漏洞来破解加密保护机制。(CVE-2017-6339) - rest/commonlog/report/template 中存在跨站脚本 (XSS) 漏洞，这是由于未正确清理用户提供的名称字段输入所致。低权限的经身份验证的远程攻击者可加以恶意利用，在创建新报告时注入任意 JavaScript。此外，由于访问控制不正确，攻击者可恶意利用此问题来创建或修改报告，进而在用户浏览报告或 auditlog 页面时，在用户的浏览器会话上执行任意脚本代码。(CVE-2017-6340) - 此外，还报告了其他漏洞，其中最严重的漏洞允许未经身份验证的远程攻击者注入命令，或执行任意代码。

解决方案

升级到 Trend Micro IWSVA 6.5 Build 1746 或更高版本。

另见

https://success.trendmicro.com/solution/1116960

https://www.zerodayinitiative.com/advisories/ZDI-17-193/

https://www.zerodayinitiative.com/advisories/ZDI-17-194/

https://www.zerodayinitiative.com/advisories/ZDI-17-195/

https://www.zerodayinitiative.com/advisories/ZDI-17-196/

https://www.zerodayinitiative.com/advisories/ZDI-17-197/

https://www.zerodayinitiative.com/advisories/ZDI-17-198/

https://www.zerodayinitiative.com/advisories/ZDI-17-199/

https://www.zerodayinitiative.com/advisories/ZDI-17-200/

https://www.zerodayinitiative.com/advisories/ZDI-17-201/

https://www.zerodayinitiative.com/advisories/ZDI-17-202/

https://www.zerodayinitiative.com/advisories/ZDI-17-203/

https://www.zerodayinitiative.com/advisories/ZDI-17-204/

https://www.zerodayinitiative.com/advisories/ZDI-17-205/

https://www.zerodayinitiative.com/advisories/ZDI-17-206/

https://www.zerodayinitiative.com/advisories/ZDI-17-207/

https://www.zerodayinitiative.com/advisories/ZDI-17-208/

https://www.zerodayinitiative.com/advisories/ZDI-17-209/

https://www.zerodayinitiative.com/advisories/ZDI-17-210/

https://www.zerodayinitiative.com/advisories/ZDI-17-211/

https://www.zerodayinitiative.com/advisories/ZDI-17-212/

https://www.zerodayinitiative.com/advisories/ZDI-17-213/

https://www.zerodayinitiative.com/advisories/ZDI-17-214/

https://www.zerodayinitiative.com/advisories/ZDI-17-215/

https://www.zerodayinitiative.com/advisories/ZDI-17-216/

https://www.zerodayinitiative.com/advisories/ZDI-17-217/

https://www.zerodayinitiative.com/advisories/ZDI-17-218/

https://www.zerodayinitiative.com/advisories/ZDI-17-219/

https://www.zerodayinitiative.com/advisories/ZDI-17-220/

https://www.zerodayinitiative.com/advisories/ZDI-17-221/

https://www.zerodayinitiative.com/advisories/ZDI-17-222/

https://www.zerodayinitiative.com/advisories/ZDI-17-223/

https://www.zerodayinitiative.com/advisories/ZDI-17-224/

https://www.zerodayinitiative.com/advisories/ZDI-17-225/

https://www.zerodayinitiative.com/advisories/ZDI-17-226/

https://www.zerodayinitiative.com/advisories/ZDI-17-227/

https://www.zerodayinitiative.com/advisories/ZDI-17-228/

https://www.zerodayinitiative.com/advisories/ZDI-17-229/

https://www.zerodayinitiative.com/advisories/ZDI-17-230/

https://www.zerodayinitiative.com/advisories/ZDI-17-231/

https://www.zerodayinitiative.com/advisories/ZDI-17-232/

https://www.zerodayinitiative.com/advisories/ZDI-17-233/

插件详情

严重性: Medium

ID: 99248

文件名: trendmicro_iwsva_6_5_1746.nasl

版本: 1.6

类型: local

系列: Firewalls

发布时间: 2017/4/7

最近更新时间: 2019/11/13

支持的传感器: Nessus

风险信息

VPR

风险因素: Medium

分数: 4.4

CVSS v2

风险因素: Medium

基本分数: 4

时间分数: 3.1

矢量: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS 分数来源: CVE-2017-6339

CVSS v3

风险因素: Medium

基本分数: 6.5

时间分数: 5.9

矢量: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

时间矢量: CVSS:3.0/E:P/RL:O/RC:C

漏洞信息

CPE: cpe:/a:trendmicro:interscan_web_security_virtual_appliance

必需的 KB 项: Host/TrendMicro/IWSVA/version

可利用: true

易利用性: Exploits are available

补丁发布日期: 2017/3/28

漏洞发布日期: 2017/3/28

参考资料信息

CVE: CVE-2017-6338, CVE-2017-6339, CVE-2017-6340