JVN#48847535: Trend Micro enterprise products multiple vulnerabilities

Multiple enterprise products provided by Trend Micro Incorporated contain the following vulnerabilities.

Directory Traversal - CVE-2016-1223

HTTP Header Injection - CVE-2016-1224

According to the developer, exploiting these vulnerabilities requires access to the LAN environment of the user.

Impact

An attacker that can access the user’s LAN environment may obtain access to files on the device. (CVE-2016-1223)
An arbitrary script may be executed on the user’s web browser. (CVE-2016-1224)

Solution

If using Office Scan 11.0:
Apply the Update Module
Contact the developer’s suuport center and inquire about the Update Module (HotFix).
According to the developer, applying the Critical Patch planned for release at the end of June 2016 will also address the vulnerability.

If using Worry-Free Business Security 9.0:
Update the software
According to the developer, applying Service Pack 3 planned for release at the end of June 2016 will address the vulnerabilities.

If using Worry-Free Business Security Service 5.x:
Update the Software
Update the software according to the information provided by the developer.

Products Affected

• Office Scan 11.0 (CVE-2016-1223)
• Worry-Free Business Security 9.0 (CVE-2016-1223, CVE-2016-1224)
• Worry-Free Business Security Service 5.x (CVE-2016-1223, CVE-2016-1224)