TippingPoint Threat Intelligence and Zero-Day Coverage – Week of July 3, 2017

It has been quoted by Albert Einstein, Benjamin Franklin, and others that insanity is “doing the same thing over and over again and expecting different results.” I could say that in our world of cyber security, despite all the headlines about data breaches and ransomware, there is no “insanity.”...

Trend Micro IWSVA DeploymentWizardAction GetClusterInfo Command Injection

A command injection vulnerability exists in Trend Micro InterScan Web Security Virtual Appliance IWSVA. The vulnerability is due to improper validation of the HTTP request parameters in the GetClusterInfo method of the DeploymentWizardAction class. A remote, authenticated attacker can exploit thi...

Trend Micro Internet Security Denial of Service Vulnerability

Trend Micro Internet Security is a set of Trend Micro Trend Micro integrated with personal firewall, anti-virus, anti-spam and other features in one network security software. A denial of service vulnerability exists in Trend Micro Internet Security. The vulnerability stems from a pointer referen...

Trend Micro SafeSync for Enterprise license Command Injection

A command injection vulnerability exists in Trend Micro's SafeSync for Enterprise. The vulnerability is due to insufficient validation of the user-supplied parameter sent to the license end point. A remote, authenticated attacker could exploit this vulnerability by sending a crafted input to the...

Tradition and Technology: Trend Micro Takes to the Water for Dragon Boat Challenge

At Trend Micro, we’re used to fighting it out against a constant barrage of cyber threats facing our customers. But we don’t just want to be number one in cybersecurity: We’re also highly competitive elsewhere. As a company proud of our East Asian links we’re keen Dragon Boat racers, and guess...

Trend Micro InterScan Web Security XML Entity Injection Vulnerability

Trend Micro InterScan Web Security is a Web security gateway that provides dynamic, integrated security for enterprise networks against Web-based threats. Trend Micro InterScan Web Security suffers from an xml entity injection vulnerability. An attacker can exploit this vulnerability to read...

Trend Micro InterScan Web Security Arbitrary Command Execution Vulnerability

Trend Micro InterScan Web Security is a Web security gateway that provides dynamic, integrated security for enterprise networks against Web-based threats. An arbitrary command execution vulnerability exists in Trend Micro InterScan Web Security. Port settings are not handled correctly due to SSH...

Web Hosting Company Pays $1 Million to Ransomware Hackers to Get Files Back

South Korean web hosting provider has agreed to pay $1 million in bitcoins to hackers after a Linux ransomware infected its 153 servers, encrypting 3,400 business websites and their data, hosted on them. According to a blog post published by NAYANA, the web hosting company, this unfortunate event...

openSUSE Security Update : lynis (openSUSE-2017-705)

This update for lynis fixes the following issues : Lynis 2.5.1 : - Improved detection of SSL certificate files - Minor changes to improve logging and results - Firewall tests: Determine if CSF is in testing mode The Update also includes changes from Lynis 2.5.0 : - CVE-2017-8108: symlink attack m...

Trend Micro IWSVA ManageSRouteSettings HttpServlet Command Injection

A command injection vulnerability exists in Trend Micro IWSVA. This vulnerability is due to incorrect validation of the netid, netmask, router, and interfacevlanidsel HTTP parameters by the ManageSRouteSettings Servlet. A remote authenticated attacker could exploit this vulnerability by sending a...

Microsoft Windows TDX Local Elevation of Privilege Vulnerability

Microsoft Windows is a series of operating systems released by Microsoft Corporation in the U.S. TDX is a multifunctional securities information platform of China Fortune Trend Technology Corporation. A local elevation of privilege vulnerability exists in Microsoft Windows TDX. A local attacker c...

Trend Micro InterScan Web Security Virtual Appliance VerboseLog Directory Traversal

A directory traversal vulnerability exists in Trend Micro InterScan Web Security Virtual Appliance IWSVA. The vulnerability is due to improper validation of the HTTP request parameters when processing requests to the VerboseLog servlet. A remote, authenticated attacker can exploit this...

FIRST and Beyond – a History of Elevating Research through Partnerships

At the FIRST conference in San Juan, Trend Micro’s Forward-looking Threat Research team will be presenting four sessions on a wide range of topics. These sessions will demonstrate a sliver of the research going on at Trend Micro, and some of the partnerships that elevate the research to benefit t...

Can YOU spot the fake?

As we predicted in 2016, cyberpropaganda is a major growth area for cybercriminals. Per that prediction, “The rise in the Internet penetration has opened the opportunity for invested parties to use the Internet as a free-for-all tool to influence public opinion to go one way or another.” Today, w...

Beware! Over 800 Android Apps on Google Play Store Contain 'Xavier' Malware

Over 800 different Android apps that have been downloaded millions of times from Google Play Store found to be infected with malicious ad library that silently collects sensitive user data and can perform dangerous operations. Dubbed "Xavier," the malicious ad library, initially emerged in...

Trend Micro Maximum Security tmusa Kernel Driver Untrusted Pointer Dereference Denial of Service Vulnerability

This vulnerability allows local attackers to deny service on vulnerable installations of Trend Micro Maximum Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the processi...

Trend Micro Maximum Security tmusa Time-Of-Check/Time-Of-Use Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privilege on vulnerable installations of Trend Micro Maximum Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

Trend Micro SafeSync for Enterprise deviceTool.pm get_device_info SQL Injection

An SQL Injection vulnerability exists in Trend Micro's SafeSync for Enterprise deviceTool.pm page. The vulnerability is due to insufficient validation of the user-supplied role or deviceid parameter when sending a query to get the information about a SafeSync storage device. A remote,...

Trend Micro SafeSync for Enterprise deviceTool.pm get_nic_device SQL Injection

An SQL Injection vulnerability exists in Trend Micro's SafeSync's deviceTool.pm Perl module. The vulnerability is due to insufficient validation of the user-supplied role or role parameter when sending a query to get the information about a SafeSync nic device. A remote, authenticated, attacker...

This Week in Security News

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. Below you’ll find a quick recap of topics followed by links to news articles and/or our blog posts providing additional insight. Be sure to check back...