PT-2007-2595 · Trend Micro · Trend Micro Serverprotect For Linux

Publicado 2007-02-28 · Atualizado 2011-03-08 · CVE-2007-1168

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Trend Micro ServerProtect for Linux (SPLX) versions 1.25, 1.3, and 2.5 before 20070216

Description The issue allows remote attackers to access arbitrary web pages and reconfigure the product via HTTP requests with the splx 2376 info cookie to the web interface port (14942/tcp).

Recommendations For versions 1.25, 1.3, and 2.5 before 20070216, consider restricting access to the web interface port 14942/tcp until a fix is applied. As a temporary workaround, avoid using the splx 2376 info cookie in HTTP requests to the web interface until the issue is resolved.

Correção

Identificadores relacionados

CVE-2007-1168

Produtos afetados

Trend Micro Serverprotect For Linux

Referências · 8

• http://secunia.com/advisories/24264 · Aviso do Fabricante
• http://securityfocus.com/bid/22662 · Correção
• http://securitytracker.com/id?1017685 · Correção
• http://trendmicro.com/download/product.asp?productid=20 · Correção
• http://vupen.com/english/advisories/2007/0691 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1168 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1168 · Nota de Segurança
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=477 · Aviso do Fabricante