Sign-up

ID

VAR-201703-1294


CVE

CVE-2017-6798


TITLE

Trend Micro Endpoint Sensor In DLL Hijack vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-002184

DESCRIPTION

Trend Micro Endpoint Sensor 1.6 before b1290 has a DLL hijacking vulnerability that allows remote attackers to execute arbitrary code, aka Trend Micro Vulnerability Identifier 2015-0208. Failed exploit attempts will result in a denial of service condition. The software provides features such as visibility so that incident responders can plan remediation and prevention of future attacks

Trust: 1.98

sources: NVD: CVE-2017-6798 // JVNDB: JVNDB-2017-002184 // BID: 96857 // VULHUB: VHN-115001

AFFECTED PRODUCTS

vendor:trendmicromodel:endpoint sensorscope:lteversion:1.6

Trust: 1.0

vendor:trend micromodel:endpoint sensorscope:eqversion:1.6

Trust: 0.9

vendor:trend micromodel:endpoint sensorscope:eqversion:1.6 b1290

Trust: 0.8

vendor:trend micromodel:endpoint sensorscope:ltversion:1.6

Trust: 0.8

vendor:trend micromodel:endpoint sensor b1290scope:neversion:1.6

Trust: 0.3

sources: BID: 96857 // JVNDB: JVNDB-2017-002184 // CNNVD: CNNVD-201703-469 // NVD: CVE-2017-6798

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-6798
value: HIGH

Trust: 1.0

NVD: CVE-2017-6798
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201703-469
value: HIGH

Trust: 0.6

VULHUB: VHN-115001
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2017-6798
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-115001
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-6798
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2017-6798
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-115001 // JVNDB: JVNDB-2017-002184 // CNNVD: CNNVD-201703-469 // NVD: CVE-2017-6798

PROBLEMTYPE DATA

problemtype:CWE-426

Trust: 1.9

sources: VULHUB: VHN-115001 // JVNDB: JVNDB-2017-002184 // NVD: CVE-2017-6798

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201703-469

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-201703-469

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-002184

PATCH
title:Solution Id:1116827url:https://success.trendmicro.com/solution/1116827
Trust: 0.8
title:Trend Micro Endpoint Sensor Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=68340
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2017-002184 // 
            
            
            
            CNNVD: CNNVD-201703-469

EXTERNAL IDS
db:NVDid:CVE-2017-6798
Trust: 2.8
db:BIDid:96857
Trust: 2.0
db:JVNDBid:JVNDB-2017-002184
Trust: 0.8
db:CNNVDid:CNNVD-201703-469
Trust: 0.7
db:VULHUBid:VHN-115001
Trust: 0.1
sources:
            
            
            VULHUB: VHN-115001 // 
            
            
            
            BID: 96857 // 
            
            
            
            JVNDB: JVNDB-2017-002184 // 
            
            
            
            CNNVD: CNNVD-201703-469 // 
            
            
            
            NVD: CVE-2017-6798

REFERENCES
url:http://www.securityfocus.com/bid/96857
Trust: 1.7
url:https://success.trendmicro.com/solution/1116827
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-6798
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-6798
Trust: 0.8
url:http://www.trend.com
Trust: 0.3
url:http://files.trendmicro.com/products/largefile/endpointsensor/tmes_1.6_build1290_readme.txt 
Trust: 0.3
url:https://success.trendmicro.com/solution/1116827 
Trust: 0.3
sources:
            
            
            VULHUB: VHN-115001 // 
            
            
            
            BID: 96857 // 
            
            
            
            JVNDB: JVNDB-2017-002184 // 
            
            
            
            CNNVD: CNNVD-201703-469 // 
            
            
            
            NVD: CVE-2017-6798

CREDITS
Himanshu Mehta
Trust: 0.3
sources:
            
            
            BID: 96857

SOURCES
db:VULHUBid:VHN-115001
db:BIDid:96857
db:JVNDBid:JVNDB-2017-002184
db:CNNVDid:CNNVD-201703-469
db:NVDid:CVE-2017-6798

LAST UPDATE DATE
2024-11-23T22:26:51.351000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-115001date:2017-03-16T00:00:00
db:BIDid:96857date:2017-03-16T00:02:00
db:JVNDBid:JVNDB-2017-002184date:2017-03-31T00:00:00
db:CNNVDid:CNNVD-201703-469date:2021-08-10T00:00:00
db:NVDid:CVE-2017-6798date:2024-11-21T03:30:33.133

SOURCES RELEASE DATE
db:VULHUBid:VHN-115001date:2017-03-10T00:00:00
db:BIDid:96857date:2017-02-24T00:00:00
db:JVNDBid:JVNDB-2017-002184date:2017-03-31T00:00:00
db:CNNVDid:CNNVD-201703-469date:2017-03-13T00:00:00
db:NVDid:CVE-2017-6798date:2017-03-10T10:59:00.453