d. Append ":/tmp" to the value:

NOTE: Removing ":/tmp" removes the restriction. e. Save the changes and close the file. ------------------------------------------------------------------- Issue 6: Users can set or add any path for the backup directory. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 6: This critical patch resolves this vulnerability by restricting the backup directory path to specific paths only. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Procedure 6: To set or add the "/tmp" folder for the backup directory: a. Install this critical patch (see "Installation"). b. Open the "tmsplx.xml" file under the "/opt/TrendMicro/SProtectLinux" folder using a text editor. c. In the "Scan" group of "tmsplx.xml", locate the "SaveToWhiteList" string, the default string is as follows:

d. Append ":/tmp" to the value:

NOTE: Removing ":/tmp" removes the restriction. e. Save the changes and close the file. ------------------------------------------------------------------- Issue 7: The ServerProtect for Linux 3.0 web console is affected by a CSRF vulnerability. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 7: This critical patch resolves the CSRF vulnerability by adding a secure random token for the web console. ------------------------------------------------------------------- Enhancement: This critical patch updates the Apache server to version 2.4.25 and its OpenSSL module to version 1.0.2k. 1.2 Files Included in This Release =================================================================== A. Files for Current Issue ------------------------------------------------------------------- Filename Build Number ------------------------------------------------------------------- install.sh n/a rollback.sh n/a Patch.ini n/a log_management.cgi 3.0.1531 proption.cgi 3.0.1531 scanoption_set.cgi 3.0.1531 showpage.cgi 3.0.1531 tmcm_sso.cgi 3.0.1531 cmoption.cgi 3.0.1531 login_and_register.cgi 3.0.1531 scanoption.cgi 3.0.1531 srv_admin.cgi 3.0.1531 viewlog.cgi 3.0.1531 notification.cgi 3.0.1531 summary.cgi 3.0.1531 CMconfig 3.0.1531 DiagnosticTool 3.0.1531 xmlvalidator 3.0.1531 entity 3.0.1531 vsapiapp 3.0.1531 splxmain 3.0.1531 splxhttpd 3.0.1531 splxhttpd.conf 3.0.1531 Specifying_the_Download_Source.htm 3.0.1531 summary.htm 3.0.1531 backup_directory.htm 3.0.1531 cmsettings_no_reg.htm 3.0.1531 cmsettings_reged.htm 3.0.1531 password.htm 3.0.1531 pr_activate.htm 3.0.1531 pr_activate_rej.htm 3.0.1531 pr_licenseinfo_full_ac_end.htm 3.0.1531 pr_licenseinfo_full_ac.htm 3.0.1531 pr_licenseinfo_full_ac_progress.htm 3.0.1531 pr_licenseinfo_no_ac.htm 3.0.1531 proxy_settings.htm 3.0.1531 proxy_settings_update.htm 3.0.1531 quarantine_directory.htm 3.0.1531 registration.htm 3.0.1531 exclusion_manual.htm 3.0.1531 exclusion_manual_response.htm 3.0.1531 exclusion_real.htm 3.0.1531 exclusion_real_response.htm 3.0.1531 exclusion_scheduled.htm 3.0.1531 exclusion_scheduled_response.htm 3.0.1531 script_splx.js 3.0.1531 log_directory.htm 3.0.1531 logs_on_disk.htm 3.0.1531 purge_now.htm 3.0.1531 scan_logs.htm 3.0.1531 spyware_logs.htm 3.0.1531 system_logs.htm 3.0.1531 virus_logs.htm 3.0.1531 Alerts.htm 3.0.1531 Recipients.htm 3.0.1531 Manual.htm 3.0.1531 Real-time.htm 3.0.1531 scan_progress0.htm 3.0.1531 scan_progress.htm 3.0.1531 Scheduled.htm 3.0.1531 Update_Manual.htm 3.0.1531 Update_Scheduled.htm 3.0.1531 B. Files for Previous Issues ------------------------------------------------------------------- Not applicable. 2. Documentation Set ====================================================================== To download or view electronic versions of the documentation set for this product, go to http://docs.trendmicro.com In addition to this Readme file, the documentation set for this product includes the following: - Online Help: The Online Help contains an overview of features and key concepts, and information on configuring and maintaining ServerProtect. To access the Online Help, go to http://docs.trendmicro.com - Installation Guide (IG): The Installation Guide contains information on requirements and procedures for installing and deploying ServerProtect. - Administrator's Guide (AG): The Administrator's Guide contains an overview of features and key concepts, and information on configuring and maintaining ServerProtect. - Getting Started Guide (GSG): The Getting Started Guide contains product overview, installation planning, installation and configuration instructions, and basic information intended to get ServerProtect "up and running". - Support Portal: The Support Portal contains information on troubleshooting and resolving known issues. To access the Support Portal, go to http://esupport.trendmicro.com 3. System Requirements ====================================================================== Install this critical patch only on computers protected by ServerProtect for Linux 3.0 Patch 7 for Service Pack 1. 4. Installation ====================================================================== This section explains key steps for installing the critical patch. 4.1 Installing =================================================================== To install: 1. Log on as a root user. 2. Upload and copy the critical file to a working directory. For example, "/home/workdir." 3. Run the following command to extract the critical patch files from the "tar.gz" file. # tar zxvf splx_30_lx_en_criticalpatch1531.tar.gz 4. Go to the critical patch directory. Run the following command: #./install.sh The original files are backed-up in folder: /opt/TrendMicro/SProtectLinux/backup/cp1531 4.2 Uninstalling =================================================================== To roll back to the previous build: 1. Log on as a root user. 2. Go to the critical patch directory. Run the following command: #./rollback.sh All current files are replaced with the back up files generated during installation. 3. Clear the cookies from the web browser. NOTE: You can rollback ServerProtect only to the last build, rollback to any older build is NOT supported. 5. Post-Installation Configuration ====================================================================== No post-installation steps are required. NOTE: Trend Micro recommends that you update your scan engine and virus pattern files immediately after installing the product. 6. Known Issues ====================================================================== There are no known issues for this critical patch release. 7. Release History ====================================================================== For more information about updates to this product, go to: http://www.trendmicro.com/download 8. Contact Information ====================================================================== A license to Trend Micro software usually includes the right to product updates, pattern file updates, and basic technical support for one (1) year from the date of purchase only. After the first year, you must renew Maintenance on an annual basis at Trend Micro's then-current Maintenance fees. Contact Trend Micro via fax, phone, and email, or visit our website to download evaluation copies of Trend Micro products. http://www.trendmicro.com/us/about-us/contact/index.html NOTE: This information is subject to change without notice. 9. About Trend Micro ====================================================================== Smart, simple, security that fits As a global leader in IT security, Trend Micro develops innovative security solutions that make the world safe for businesses and consumers to exchange digital information. Copyright 2017, Trend Micro Incorporated. All rights reserved. Trend Micro, ServerProtect, and the t-ball logo are trademarks of Trend Micro Incorporated and are registered in some jurisdictions. All other marks are the trademarks or registered trademarks of their respective companies. 10. License Agreement ====================================================================== View information about your license agreement with Trend Micro at: http://www.trendmicro.com/us/about-us/legal-policies/ license-agreements Third-party licensing agreements can be viewed: - By selecting the "About" option in the application user interface - By referring to the "Legal" page of the Administrator's Guide