Trend Micro Patches Serious Flaws in Product Used by Companies, Governments

guest · Dec 17, 2020

Trend Micro Patches Serious Flaws in Product Used by Companies, Governments
December 17, 2020
https://www.securityweek.com/trend-micro-patches-serious-flaws-product-used-companies-governments

Trend Micro informed customers this week that an update for its InterScan Web Security Virtual Appliance (IWSVA) patches several potentially serious vulnerabilities, including ones that can be exploited to remotely take control of the appliance
Click to expand...

The vulnerabilities were discovered by Wolfgang Ettlinger, a researcher at Austria-based cybersecurity consultancy SEC Consult, and they were reported to Trend Micro in the summer of 2019. However, the vendor only managed to completely patch all of the security holes in late November 2020, with the release of IWSVA 6.5 SP2 CP b1919.

While the validation and patching process took a fairly long time, SEC Consult told SecurityWeek that the Trend Micro PSIRT handled the issue very professionally, “in contrast to other larger companies we have encountered in the past.”
Click to expand...

SEC Consult has published an advisory containing technical information for each of the vulnerabilities, but the company says it’s not releasing the actual PoC exploits. A video demonstrating an attack has also been made available:

“We have released a critical patch that resolves these vulnerabilities and the solution is available now. We recommend customers apply the patch and review our bulletin for some additional best practice configuration recommendations.”
Click to expand...

Log in or Sign up

Trend Micro Patches Serious Flaws in Product Used by Companies, Governments

guest Guest

Log in or Sign up

Trend Micro Patches Serious Flaws in Product Used by Companies, Governments

guest Guest

Useful Searches