Trend Micro Linux-based Email Encryption Gateway exist multiple security vulnerabilities

According to securityaffairs on Feb. 25, Core Security has found several security vulnerabilities (CVE-2018-6219 ~ CVE-2018-6230) in the web console of Trend Micro’s Linux-based email encryption gateway, some of which were rated as grave Vulnerabilities allow unauthenticated remote attackers to execute arbitrary commands with root privileges. The packages currently affected are Trend Micro Email Encryption Gateway 5.5 (build 1111.00) and earlier.

The most serious of these vulnerabilities, CVE-2018-6223, may be exploited by local or remote attackers to gain root privileges on target devices to facilitate arbitrary command execution. For now, the vulnerability relates to lack of authentication when the device is registered.

The details are as follows: During deployment, the administrator needs to configure the virtual device that runs the email encryption gateway by registering the endpoint so that an attacker can access the endpoint without authentication to set up administrator credentials and configure the configuration Other changes, such as administrator user name and password.

It is reported that Core Security also found two serious cross-site scripting attacks (XSS) vulnerabilities, one can lead to arbitrary file write command execution issues, the other led to the implementation of arbitrary command log file location and unverified software updates. In addition, Trend Micro’s email encryption gateway also includes vulnerabilities such as SQL and XML External Entity (XXE) injection.

Trend Micro confirmed that a medium severity CSRF issue and a low severity SQL injection vulnerability have not been patched due to the difficulties of implementing a fix.

Source: SecurityAffairs