Sign-up

ID

VAR-201604-0114


CVE

CVE-2016-3987


TITLE

Trend Micro Password Manager HTTP Server arbitrary command execution vulnerability

Trust: 1.4

sources: IVD: e06590a6-1e3b-11e6-abef-000c29c66e3d // CNVD: CNVD-2016-02208 // CNNVD: CNNVD-201604-205

DESCRIPTION

The HTTP server in Trend Micro Password Manager allows remote web servers to execute arbitrary commands via the url parameter to (1) api/openUrlInDefaultBrowser or (2) api/showSB. Supplementary information : CWE Vulnerability type by CWE-284: Improper Access Control ( Inappropriate access control ) Has been identified. Trend Micro is a global leader in network security software and services, leading the trend from desktop anti-virus to web server and gateway anti-virus with superior forward-looking and technological innovation. It demonstrates the forward-looking trend of Trend Micro with the unique service concept. And leadership. There is a default password management software installed when the user installs Trend Micro anti-virus software on the Windows version, and it is self-starting. There is a loophole in the execution code when multiple http rpc ports of node.js process API requests in the java environment. Allows an attacker to exploit this vulnerability to execute arbitrary code. The program helps users easily access all of their online accounts, and supports the simultaneous management of online credentials across multiple devices in the cloud and more. Attackers can use these vulnerabilities to execute arbitrary commands in the context of an affected application or to leak sensitive information. It has proved the industry's foresight with unique service concepts And leadership

Trust: 4.68

sources: NVD: CVE-2016-3987 // JVNDB: JVNDB-2016-002096 // CNVD: CNVD-2016-02208 // CNVD: CNVD-2016-00272 // CNVD: CNVD-2016-00228 // CNNVD: CNNVD-201601-276 // BID: 80260 // IVD: e06590a6-1e3b-11e6-abef-000c29c66e3d // IVD: 215a3f74-1e4d-11e6-abef-000c29c66e3d // IVD: bc0981ba-1e4d-11e6-abef-000c29c66e3d // VULMON: CVE-2016-3987

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 2.4

sources: IVD: e06590a6-1e3b-11e6-abef-000c29c66e3d // IVD: 215a3f74-1e4d-11e6-abef-000c29c66e3d // IVD: bc0981ba-1e4d-11e6-abef-000c29c66e3d // CNVD: CNVD-2016-02208 // CNVD: CNVD-2016-00272 // CNVD: CNVD-2016-00228

AFFECTED PRODUCTS

vendor:trend micromodel:password managerscope: - version: -

Trust: 2.0

vendor:trendmicromodel:password managerscope:eqversion: -

Trust: 1.0

vendor:trend micromodel:trend microscope: - version: -

Trust: 0.6

vendor:trend micromodel:password managerscope:eqversion: -

Trust: 0.6

vendor:password managermodel: - scope:eqversion: -

Trust: 0.4

vendor:trend micromodel: - scope:eqversion:*

Trust: 0.4

sources: IVD: e06590a6-1e3b-11e6-abef-000c29c66e3d // IVD: 215a3f74-1e4d-11e6-abef-000c29c66e3d // IVD: bc0981ba-1e4d-11e6-abef-000c29c66e3d // CNVD: CNVD-2016-02208 // CNVD: CNVD-2016-00272 // CNVD: CNVD-2016-00228 // JVNDB: JVNDB-2016-002096 // CNNVD: CNNVD-201604-205 // NVD: CVE-2016-3987

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-3987
value: CRITICAL

Trust: 1.0

NVD: CVE-2016-3987
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2016-02208
value: HIGH

Trust: 0.6

CNVD: CNVD-2016-00272
value: HIGH

Trust: 0.6

CNVD: CNVD-2016-00228
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201604-205
value: CRITICAL

Trust: 0.6

IVD: e06590a6-1e3b-11e6-abef-000c29c66e3d
value: CRITICAL

Trust: 0.2

IVD: 215a3f74-1e4d-11e6-abef-000c29c66e3d
value: CRITICAL

Trust: 0.2

IVD: bc0981ba-1e4d-11e6-abef-000c29c66e3d
value: HIGH

Trust: 0.2

VULMON: CVE-2016-3987
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2016-3987
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2016-02208
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

CNVD: CNVD-2016-00272
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

CNVD: CNVD-2016-00228
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: e06590a6-1e3b-11e6-abef-000c29c66e3d
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

IVD: 215a3f74-1e4d-11e6-abef-000c29c66e3d
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

IVD: bc0981ba-1e4d-11e6-abef-000c29c66e3d
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

nvd@nist.gov: CVE-2016-3987
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2016-3987
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: IVD: e06590a6-1e3b-11e6-abef-000c29c66e3d // IVD: 215a3f74-1e4d-11e6-abef-000c29c66e3d // IVD: bc0981ba-1e4d-11e6-abef-000c29c66e3d // CNVD: CNVD-2016-02208 // CNVD: CNVD-2016-00272 // CNVD: CNVD-2016-00228 // VULMON: CVE-2016-3987 // JVNDB: JVNDB-2016-002096 // CNNVD: CNNVD-201604-205 // NVD: CVE-2016-3987

PROBLEMTYPE DATA

problemtype:CWE-284

Trust: 1.0

problemtype:CWE-Other

Trust: 0.8

sources: JVNDB: JVNDB-2016-002096 // NVD: CVE-2016-3987

THREAT TYPE

remote

Trust: 1.2

sources: CNNVD: CNNVD-201601-276 // CNNVD: CNNVD-201604-205

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201601-276

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-002096

EXPLOIT AVAILABILITY
sources:
            
            
            VULMON: CVE-2016-3987

PATCH
title:Issue 693url:https://bugs.chromium.org/p/project-zero/issues/detail?id=693&redir=1
Trust: 0.8
title:Information on Reported Vulnerabilities in Trend Micro Password Managerurl:http://blog.trendmicro.com/information-on-reported-vulnerabilities-in-trend-micro-password-manager/
Trust: 0.8
title:Trend Micro Password Manager HTTP server arbitrary command execution vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/74080
Trust: 0.6
title:Trend Micro Password Manager has multiple vulnerabilitiesurl:https://www.cnvd.org.cn/patchInfo/show/70202
Trust: 0.6
title:TrendMicro node.js http server arbitrary command execution vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/70044
Trust: 0.6
title:Trend Micro Password Manager HTTP Repair measures for server arbitrary command execution vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=60893
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2016-02208 // 
            
            
            
            CNVD: CNVD-2016-00272 // 
            
            
            
            CNVD: CNVD-2016-00228 // 
            
            
            
            JVNDB: JVNDB-2016-002096 // 
            
            
            
            CNNVD: CNNVD-201604-205

EXTERNAL IDS
db:NVDid:CVE-2016-3987
Trust: 3.8
db:EXPLOIT-DBid:39218
Trust: 2.9
db:PACKETSTORMid:135222
Trust: 2.3
db:SECTRACKid:1034662
Trust: 1.7
db:BIDid:80260
Trust: 1.6
db:EXPLOITDBid:39218
Trust: 1.2
db:CNNVDid:CNNVD-201604-205
Trust: 1.0
db:CNVDid:CNVD-2016-02208
Trust: 0.8
db:CNVDid:CNVD-2016-00272
Trust: 0.8
db:CNVDid:CNVD-2016-00228
Trust: 0.8
db:JVNDBid:JVNDB-2016-002096
Trust: 0.8
db:CNNVDid:CNNVD-201601-276
Trust: 0.6
db:IVDid:E06590A6-1E3B-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:IVDid:215A3F74-1E4D-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:IVDid:BC0981BA-1E4D-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:VULMONid:CVE-2016-3987
Trust: 0.1
sources:
            
            
            IVD: e06590a6-1e3b-11e6-abef-000c29c66e3d // 
            
            
            
            IVD: 215a3f74-1e4d-11e6-abef-000c29c66e3d // 
            
            
            
            IVD: bc0981ba-1e4d-11e6-abef-000c29c66e3d // 
            
            
            
            CNVD: CNVD-2016-02208 // 
            
            
            
            CNVD: CNVD-2016-00272 // 
            
            
            
            CNVD: CNVD-2016-00228 // 
            
            
            
            VULMON: CVE-2016-3987 // 
            
            
            
            BID: 80260 // 
            
            
            
            JVNDB: JVNDB-2016-002096 // 
            
            
            
            CNNVD: CNNVD-201601-276 // 
            
            
            
            CNNVD: CNNVD-201604-205 // 
            
            
            
            NVD: CVE-2016-3987

REFERENCES
url:https://www.exploit-db.com/exploits/39218/
Trust: 3.0
url:http://blog.trendmicro.com/information-on-reported-vulnerabilities-in-trend-micro-password-manager/
Trust: 2.3
url:https://code.google.com/p/google-security-research/issues/detail?id=693
Trust: 2.3
url:http://packetstormsecurity.com/files/135222/trendmicro-node.js-http-server-command-execution.html
Trust: 2.3
url:http://www.securitytracker.com/id/1034662
Trust: 1.7
url:http://www.securityfocus.com/bid/80260
Trust: 1.3
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-3987
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-3987
Trust: 0.8
url:http://www.trend.com
Trust: 0.3
url:http://www.trendmicro.com/us/home/products/software/password-manager/index.html
Trust: 0.3
url:https://code.google.com/p/google-security-research/issues/detail?id=693&can=1&sort=-id
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/284.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2016-02208 // 
            
            
            
            CNVD: CNVD-2016-00272 // 
            
            
            
            CNVD: CNVD-2016-00228 // 
            
            
            
            VULMON: CVE-2016-3987 // 
            
            
            
            BID: 80260 // 
            
            
            
            JVNDB: JVNDB-2016-002096 // 
            
            
            
            CNNVD: CNNVD-201601-276 // 
            
            
            
            CNNVD: CNNVD-201604-205 // 
            
            
            
            NVD: CVE-2016-3987

CREDITS
Tavis Ormandy of Google.
Trust: 0.9
sources:
            
            
            BID: 80260 // 
            
            
            
            CNNVD: CNNVD-201601-276

SOURCES
db:IVDid:e06590a6-1e3b-11e6-abef-000c29c66e3d
db:IVDid:215a3f74-1e4d-11e6-abef-000c29c66e3d
db:IVDid:bc0981ba-1e4d-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2016-02208
db:CNVDid:CNVD-2016-00272
db:CNVDid:CNVD-2016-00228
db:VULMONid:CVE-2016-3987
db:BIDid:80260
db:JVNDBid:JVNDB-2016-002096
db:CNNVDid:CNNVD-201601-276
db:CNNVDid:CNNVD-201604-205
db:NVDid:CVE-2016-3987

LAST UPDATE DATE
2024-11-23T22:56:22.368000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2016-02208date:2016-04-15T00:00:00
db:CNVDid:CNVD-2016-00272date:2016-01-19T00:00:00
db:CNVDid:CNVD-2016-00228date:2016-01-15T00:00:00
db:VULMONid:CVE-2016-3987date:2016-04-18T00:00:00
db:BIDid:80260date:2016-07-06T14:23:00
db:JVNDBid:JVNDB-2016-002096date:2016-04-19T00:00:00
db:CNNVDid:CNNVD-201601-276date:2016-01-15T00:00:00
db:CNNVDid:CNNVD-201604-205date:2021-09-10T00:00:00
db:NVDid:CVE-2016-3987date:2024-11-21T02:51:06.057

SOURCES RELEASE DATE
db:IVDid:e06590a6-1e3b-11e6-abef-000c29c66e3ddate:2016-04-15T00:00:00
db:IVDid:215a3f74-1e4d-11e6-abef-000c29c66e3ddate:2016-01-19T00:00:00
db:IVDid:bc0981ba-1e4d-11e6-abef-000c29c66e3ddate:2016-01-15T00:00:00
db:CNVDid:CNVD-2016-02208date:2016-04-15T00:00:00
db:CNVDid:CNVD-2016-00272date:2016-01-19T00:00:00
db:CNVDid:CNVD-2016-00228date:2016-01-15T00:00:00
db:VULMONid:CVE-2016-3987date:2016-04-12T00:00:00
db:BIDid:80260date:2016-01-11T00:00:00
db:JVNDBid:JVNDB-2016-002096date:2016-04-19T00:00:00
db:CNNVDid:CNNVD-201601-276date:2016-01-15T00:00:00
db:CNNVDid:CNNVD-201604-205date:2016-04-13T00:00:00
db:NVDid:CVE-2016-3987date:2016-04-12T02:00:10.430