PT-2001-2175 · Trend Micro · Trend Micro Interscan Applettrap

Published 2001-07-09 · Updated 2017-12-19 · CVE-2001-1026

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan AppletTrap version 2.0

Description The issue arises from improper URL filtering. Specifically, it does not correctly handle URLs that have been modified in certain ways, such as using a double slash (//) instead of a single slash, utilizing URL-encoded characters, requesting the IP address instead of the domain name, or including a leading 0 in an octet of an IP address.

Recommendations For Trend Micro InterScan AppletTrap version 2.0, consider updating the URL filtering mechanism to properly handle modified URLs, including those with double slashes, URL-encoded characters, IP addresses instead of domain names, and leading zeros in IP address octets. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2001-1026

Affected Products

Trend Micro Interscan Applettrap

References · 10

• http://archives.neohapsis.com/archives/bugtraq/2001-07/0129.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-1026 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6818 · Note
• http://securityfocus.com/bid/2996 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6819 · Note
• http://securityfocus.com/bid/2998 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1026 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6817 · Note
• http://securityfocus.com/bid/3000 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6816 · Note