CVE-2017-9034 Code injection in n/a
Attackers can execute arbitrary code with root privileges by exploiting a lack of validation in software updates for Trend Micro ServerProtect for Linux.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-9034?
CVE-2017-9034 is a critical code injection vulnerability in n/a, published on 25 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to write to arbitrary files and consequently execute arbitrary code with root privileges by leveraging failure to validate software updates.
Weakness: CWE-20
Which versions are affected by CVE-2017-9034?
It affects 1 product.
Products include Trendmicro Serverprotect.
How do I fix CVE-2017-9034?
No fix has been published for CVE-2017-9034 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2017-9034 being exploited?
There is no known exploitation of CVE-2017-9034 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2022-25329 Hardcoded credentials in Trend Micro ServerProtect for EMC Celerra
- CVE-2022-25330 Integer overflow in Trend Micro ServerProtect for EMC Celerra
- CVE-2021-36745 Auth bypass in Trend Micro ServerProtect for EMC Celerra
- CVE-2020-24561 Command injection in Trend Micro ServerProtect for Linux
- CVE-2017-9033 Cross-site request forgery in n/a
Sources
Also known as GHSA-rc78-crmm-7f5v.