PT-2009-1215 · Trend Micro · Trend Micro Officescan+2

Publicado 2009-01-21 · Atualizado 2017-08-08 · CVE-2008-3866

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Trend Micro OfficeScan version 8.0 SP1 Patch 1 Trend Micro Internet Security versions 2007 and 2008 17.0.1224

Description The issue allows local users to bypass intended access restrictions and change firewall settings by sending crafted packets using a modified client. This is due to the reliance on client-side password protection implemented in the configuration GUI of the Trend Micro Personal Firewall service.

Recommendations For Trend Micro OfficeScan version 8.0 SP1 Patch 1, consider restricting access to the configuration GUI to minimize the risk of exploitation. For Trend Micro Internet Security versions 2007 and 2008 17.0.1224, avoid using the modified client to send crafted packets until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2008-3866

Produtos afetados

Trend Micro Internet Security

Trend Micro Officescan

Trend Micro Personal Firewall

Referências · 11

• http://securitytracker.com/id?1021616 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48108 · Nota
• http://secunia.com/advisories/31160 · Aviso do Fabricante
• http://secunia.com/secunia_research/2008-43 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3866 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-3866 · Nota de Segurança
• http://secunia.com/advisories/33609 · Aviso do Fabricante
• http://securitytracker.com/id?1021617 · Nota
• http://vupen.com/english/advisories/2009/0191 · Nota
• http://securityfocus.com/bid/33358 · Correção
• http://trendmicro.com/ftp/documentation/readme/OSCE8.0_SP1_Patch1_CriticalPatch_3191_Readme.txt · Aviso do Fabricante