[FD] [CORE-2017-0006] Trend Micro Email Encryption Gateway Multiple Vulnerabilities

Core Security - Corelabs Advisory http://ift.tt/140w507 Trend Micro Email Encryption Gateway Multiple Vulnerabilities 1. *Advisory Information* Title: Trend Micro Email Encryption Gateway Multiple Vulnerabilities Advisory ID: CORE-2017-0006 Advisory URL: http://ift.tt/2FjbmJN Date published: 2018-02-21 Date of last update: 2018-02-21 Vendors contacted: Trend Micro Release mode: Coordinated release 2. *Vulnerability Information* Class: Cleartext Transmission of Sensitive Information [CWE-319], External Control of File Name or Path [CWE-73], Insufficient Verification of Data Authenticity [CWE-345], External Control of File Name or Path [CWE-73], Missing Authentication for Critical Function [CWE-306], Cross-Site Request Forgery [CWE-352], Improper Restriction of XML External Entity Reference [CWE-611], Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') [CWE-79], Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') [CWE-79], Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') [CWE-79], Improper Neutralization of Special Elements used in an SQL Command [CWE-89], Improper Neutralization of Special Elements used in an SQL Command [CWE-89], Improper Neutralization of Special Elements used in an SQL Command [CWE-89] Impact: Code execution Remotely Exploitable: Yes Locally Exploitable: Yes CVE Name: CVE-2018-6219, CVE-2018-6220, CVE-2018-6221, CVE-2018-6222, CVE-2018-6223, CVE-2018-6224, CVE-2018-6225, CVE-2018-6226, CVE-2018-6226, CVE-2018-6227, CVE-2018-6228, CVE-2018-6229, CVE-2018-6230 3. *Vulnerability Description* Trend Micro's website states that:[1]       Encryption for Email Gateway is a Linux-based software solution providing the ability to perform the encryption and decryption of email at the corporate gateway, regardless of the email client, and the platform from which it originated. The encryption and decryption of email on the TMEEG client is controlled by a Policy Manager that enables an administrator to configure policies based on various parameters, such as sender and recipient email addresses, keywords, or PCI compliance. Encryption for Email Gateway presents itself as an SMTP interface and delivers email out over an SMTP to configured outbound MTAs. This enables easy integration with other email server-based products, be them content scanners, mail servers, or archiving solutions."       Multiple vulnerabilities were found in the Trend Micro Email Encryption Gateway web console that would allow a remote unauthenticated attacker to gain command execution as root. We also present two additional vectors to achieve code execution from a man-in-the-middle position.       4. *Vulnerable Packages* . Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) Other products and versions might be affected, but they were not tested. 5. *Vendor Information, Solutions and Workarounds* Trend Micro published the following Security Notes: . http://ift.tt/2GxmjGV 6. *Credits* These vulnerabilities were discovered and researched by Leandro Barragan and Maximiliano Vidal from Core Security Consulting Services. The publication of this advisory was coordinated by Alberto Solino from Core Advisories Team.     7. *Technical Description / Proof of Concept Code* Trend Micro Email Encryption Gateway includes a web console to perform administrative tasks. Section 7.4 describes a vulnerability in this console that can be exploited to gain command execution as root. The vulnerable functionality is accessible only to authenticated users, but it is possible to combine 7.4 with the vulnerability presented in section 7.5 to bypass this restriction and therefore execute root commands from the perspective of a remote unauthenticated attacker.       The application does also use an insecure update mechanism that allows an attacker in a man-in-the-middle position to write arbitrary files and install arbitrary RPM packages, leading to remote command execution as the root user.       Additional Web application vulnerabilities were found, including cross-site request forgery (7.6), XML external entity injection (7.7), several cross-site scripting vulnerabilities (7.8, 7.9, 7.10), and SQL injection vulnerabilities (7.11, 7.12, 7.13).       7.1. *Insecure update via HTTP* [CVE-2018-6219] Communication to the update servers is unencrypted. The following URL is fetched when the application checks for updates:           /--

Source: Gmail -> IFTTT-> Blogger