PT-2007-4726 · Trend Micro · Trend Micro Officescan Corporate Edition+1

Publicado 2007-06-26 · Atualizado 2017-07-29 · CVE-2007-3455

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Trend Micro OfficeScan Corporate Edition versions prior to 8.0.0.142

Description The issue allows remote attackers to bypass the password requirement and gain access to the Management Console. This can be achieved via an empty hash and empty encrypted password string or through crafted HTTP headers. The problem is related to stored decrypted user logon information.

Recommendations For versions prior to 8.0.0.142, update to version 8.0.0.142 or later to resolve the issue. As a temporary workaround, consider restricting access to the Management Console to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2007-3455

Produtos afetados

Trend Micro Officescan Corporate Edition

Trend Micro Officescan Server

Referências · 12

• http://securitytracker.com/id?1018320 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-3455 · Nota de Segurança
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=558 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3455 · Nota
• http://vupen.com/english/advisories/2007/2330 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35052 · Nota
• http://secunia.com/advisories/25778 · Aviso do Fabricante
• http://frsirt.com/english/advisories/2007/2330 · Nota
• http://securityfocus.com/bid/24641 · Nota
• http://securityfocus.com/bid/24935 · Nota
• http://osvdb.org/36628 · Nota
• http://trendmicro.com/ftp/documentation/readme/osce_80_win_en_securitypatch_b1042_readme.txt · Correção