PT-2007-5468 · Trend Micro · Trend Micro Pc-Cillin Internet Security+2

Publicado

2007-10-30

·

Atualizado

2011-03-08

·

CVE-2007-4277

CVSS v2.0

6.6

Média

VetorAV:L/AC:L/Au:N/C:N/I:C/A:C
Name of the Vulnerable Software and Affected Versions Trend Micro AntiVirus scan engine versions prior to 8.550-1001 Trend Micro PC-Cillin Internet Security 2007 Tmxpflt.sys versions 8.320.1004 and 8.500.0.1002
Description The issue is related to weak permissions for the .Tmfilter device, allowing local users to send arbitrary content via the IOCTL functionality. This can be leveraged for privilege escalation by exploiting a buffer overflow in the handler for IOCTL 0xa0284403.
Recommendations For Trend Micro AntiVirus scan engine versions prior to 8.550-1001, update to version 8.550-1001 or later. For Trend Micro PC-Cillin Internet Security 2007, update the Trend Micro AntiVirus scan engine to version 8.550-1001 or later. For Tmxpflt.sys versions 8.320.1004 and 8.500.0.1002, update Tmxpflt.sys to a version later than 8.500.0.1002. As a temporary workaround, consider restricting access to the .Tmfilter device to minimize the risk of exploitation.

Correção

Buffer Overflow

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-264CWE-119

Identificadores relacionados

CVE-2007-4277

Produtos afetados

Tmxpflt.Sys
Trend Micro Antivirus Scan Engine
Trend Micro Pc-Cillin Internet Security