|
[Japanese]
|
JVNDB-2020-008762
|
ServerProtect for Linux vulnerable to OS command injection
|
|
ServerProtect for Linux provided by Trend Micro Incorporated contains an OS command injection vulnerability (CWE-78).
Incorporated reported this vulnerability to JPCERT/CC to notify users of its solution through JVN.
|
|
CVSS V3 Severity:
Base Metrics 9.1 (Critical) [IPA Score]
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Changed
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
CVSS V2 Severity:
Base Metrics 9.0 (High) [NVD Score]
- Access Vector: Network
- Access Complexity: Low
- Authentication: Single Instance
- Confidentiality Impact: Complete
- Integrity Impact: Complete
- Availability Impact: Complete
|
|
|
Trend Micro, Inc.
- Trend Micro ServerProtect for Linux 3.0
|
|
|
A remote authenticated attacker may execute arbitrary code.
|
|
[Apply the Patch]
Apply the appropriate patch according to the information provided by the developer.
The developer has released the patches listed below that contain the countermeasure to the vulnerabilities.
*Version 3.0 CP1633
[Apply the Workaround]
Applying the following workarounds may mitigate the impacts of this vulnerability.
*Only accept the SPLX consol from trusted users and connection source
|
|
Trend Micro, Inc.
|
|
- OS Command Injection(CWE-78) [Other]
|
|
- CVE-2020-24561
|
|
- JVN : JVNVU#91216654
- National Vulnerability Database (NVD) : CVE-2020-24561
|
|
- [2020/09/28]
Web page was published
|
