CERTFR-2024-AVI-0811
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits Trend Micro. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

L'éditeur indique que les versions 5.8.x à 6.5.x de Deep Discovery Inspector sont affectées par les vulnérabilités CVE-2024-46902 et CVE-2024-46903 mais ne bénéficieront pas de correctifs de sécurité. Deep Discovery Inspector et Deep Discovery Email Inspector sont affectés par la vulnérabilité CVE-2024-6387; il est nécessaire de contacter l'éditeur pour accéder aux correctifs.

Impacted products
Vendor Product Description
Trend Micro Service Gateway Service Gateway versions antérieures à 3.0.10
Trend Micro Deep Discovery Inspector Deep Discovery Inspector versions 6.7.x antérieures à 6.7 Cp 1107
Trend Micro Deep Discovery Inspector Deep Discovery Inspector versions 6.6.x antérieures à 6.6 Cp 1097
Trend Micro Trend Micro Web Gateway Trend Micro Web Gateway versions antérieures à 3.9.5.5840
Trend Micro Deep Discovery Mail Inspector Deep Discovery Email Inspector sans le dernier correctif de sécurité
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Service Gateway versions ant\u00e9rieures \u00e0 3.0.10",
      "product": {
        "name": "Service Gateway",
        "vendor": {
          "name": "Trend Micro",
          "scada": false
        }
      }
    },
    {
      "description": "Deep Discovery Inspector versions 6.7.x ant\u00e9rieures \u00e0 6.7 Cp 1107",
      "product": {
        "name": "Deep Discovery Inspector",
        "vendor": {
          "name": "Trend Micro",
          "scada": false
        }
      }
    },
    {
      "description": "Deep Discovery Inspector versions 6.6.x ant\u00e9rieures \u00e0 6.6 Cp 1097",
      "product": {
        "name": "Deep Discovery Inspector",
        "vendor": {
          "name": "Trend Micro",
          "scada": false
        }
      }
    },
    {
      "description": "Trend Micro Web Gateway\t versions ant\u00e9rieures \u00e0 3.9.5.5840",
      "product": {
        "name": "Trend Micro Web Gateway",
        "vendor": {
          "name": "Trend Micro",
          "scada": false
        }
      }
    },
    {
      "description": "Deep Discovery Email Inspector sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Deep Discovery Mail Inspector",
        "vendor": {
          "name": "Trend Micro",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "L\u0027\u00e9diteur indique que les versions 5.8.x \u00e0 6.5.x de Deep Discovery Inspector sont affect\u00e9es par les vuln\u00e9rabilit\u00e9s CVE-2024-46902 et CVE-2024-46903 mais ne b\u00e9n\u00e9ficieront pas de correctifs de s\u00e9curit\u00e9. \nDeep Discovery Inspector et Deep Discovery Email Inspector sont affect\u00e9s par la vuln\u00e9rabilit\u00e9 CVE-2024-6387; il est n\u00e9cessaire de contacter l\u0027\u00e9diteur pour acc\u00e9der aux correctifs. ",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-46903",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46903"
    },
    {
      "name": "CVE-2024-46902",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46902"
    },
    {
      "name": "CVE-2006-5051",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-5051"
    },
    {
      "name": "CVE-2024-6387",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6387"
    },
    {
      "name": "CVE-2008-4109",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-4109"
    }
  ],
  "initial_release_date": "2024-09-25T00:00:00",
  "last_revision_date": "2024-09-25T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0811",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-09-25T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Trend Micro. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Trend Micro",
  "vendor_advisories": [
    {
      "published_at": "2024-09-16",
      "title": "Bulletin de s\u00e9curit\u00e9 Trend Micro KA-0017793",
      "url": "https://success.trendmicro.com/en-US/solution/KA-0017793"
    },
    {
      "published_at": "2024-09-05",
      "title": "Bulletin de s\u00e9curit\u00e9 Trend Micro KA-0016976",
      "url": "https://success.trendmicro.com/en-US/solution/KA-0016976"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.