JVN#55428526
Deep Discovery Inspector vulnerable to remote code execution
Overview
Deep Discovery Inspector provided by Trend Micro Incorporated contains a remote code execution vulnerability.
Products Affected
- Deep Discovery Inspector 3.8 SP1 (3.81)
- Deep Discovery Inspector 3.7
- Deep Discovery Inspector 3.5
- Deep Discovery Inspector 3.2
- Deep Discovery Inspector 3.1
- Deep Discovery Inspector 3.0
For more details, refer to the information provided by the developer.
Description
Deep Discovery Inspector provided by Trend Micro Incorporated contains a remote code execution vulnerability.
Impact
An attacker who can access the product as an administrator may execute arbitrary code with the root privilege.
Solution
For Deep Discovery Inspector 3.5 and later:
Apply the patch
Apply the appropriate patch according to the information provided by the developer.
For Deep Discovery Inspector 3.2 and earlier:
Update the software and Apply the patch
Update the software to Deep Discovery Inspector 3.5 or later, and apply the appropriate patch according to the information provided by the developer.
Vendor Status
| Vendor | Link |
| Trend Micro Incorporated | Trend Micro Deep Discovery Inspector (DDI) Remote Code Execution Vulnerability |
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
| Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
|---|---|---|---|---|
| Attack Complexity(AC) | High (H) | Low (L) | ||
| Privileges Required(PR) | High (H) | Low (L) | None (N) | |
| User Interaction(UI) | Required (R) | None (N) | ||
| Scope(S) | Unchanged (U) | Changed (C) | ||
| Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
| Integrity Impact(I) | None (N) | Low (L) | High (H) | |
| Availability Impact(A) | None (N) | Low (L) | High (H) |
| Access Vector(AV) | Local (L) | Adjacent Network (A) | Network (N) |
|---|---|---|---|
| Access Complexity(AC) | High (H) | Medium (M) | Low (L) |
| Authentication(Au) | Multiple (M) | Single (S) | None (N) |
| Confidentiality Impact(C) | None (N) | Partial (P) | Complete (C) |
| Integrity Impact(I) | None (N) | Partial (P) | Complete (C) |
| Availability Impact(A) | None (N) | Partial (P) | Complete (C) |
Credit
Trend Micro Incorporated reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Trend Micro Incorporated coordinated under the Information Security Early Warning Partnership.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2016-5840 |
| JVN iPedia |
JVNDB-2016-000103 |
Update History
- 2016/07/12
- Information under the section "Products Affected", "Solution" and "Other Information" was updated.