PT-2015-6153 · Trend Micro · Trend Micro Scanmail For Exchange

Publicado 2015-05-14 · Atualizado 2017-01-03 · CVE-2015-3326

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Trend Micro ScanMail for Microsoft Exchange (SMEX) versions 10.2 before Hot Fix Build 3318 Trend Micro ScanMail for Microsoft Exchange (SMEX) versions 11.0 before Hot Fix Build 4180

Description The issue allows remote attackers to bypass authentication via a brute force attack because the session IDs for the web console are generated using a random number generator with predictable values.

Recommendations For versions 10.2 before Hot Fix Build 3318, apply Hot Fix Build 3318 to resolve the issue. For versions 11.0 before Hot Fix Build 4180, apply Hot Fix Build 4180 to resolve the issue.

Correção

Identificadores relacionados

CVE-2015-3326

Produtos afetados

Trend Micro Scanmail For Exchange

Referências · 6

• http://securitytracker.com/id/1032323 · Nota
• http://esupport.trendmicro.com/solution/en-US/1109669.aspx · Aviso do Fabricante
• http://blog.malerisch.net/2016/05/trendmicro-smex-session-predictable-cve-2015-3326.html · Nota
• http://securityfocus.com/bid/74661 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-3326 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3326 · Nota