PT-2006-1699 · Trend Micro · Trend Micro Serverprotect

Published 2006-02-10 · Updated 2018-10-19 · CVE-2006-0642

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Trend Micro ServerProtect version 5.58

Description The default configuration setting of "Do not scan compressed files when Extracted file count exceeds 500 files" may be too low, allowing remote attackers to bypass anti-virus checks by sending compressed archives containing many small files.

Recommendations For Trend Micro ServerProtect version 5.58, consider increasing the extracted file count limit to a higher value to prevent attackers from bypassing anti-virus checks. As a temporary workaround, monitor the system for messages indicating that the compressed file exceeds specified limits and manually inspect such files to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-0642

Affected Products

Trend Micro Serverprotect

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2006-0642 · Security Note
• http://packetstormsecurity.org/filedesc/Bypass.pdf.html · Vendor Advisory
• http://packetstormsecurity.org/0602-advisories/Bypass.pdf · Vendor Advisory
• http://securityfocus.com/archive/1/423896/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0642 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24658 · Note
• http://securityfocus.com/archive/1/423914/100/0/threaded · Note
• http://securityfocus.com/archive/1/424598/100/0/threaded · Note
• http://securityfocus.com/bid/16483 · Note
• http://securityfocus.com/archive/1/424172/100/0/threaded · Note
• http://securityfocus.com/archive/1/423913/100/0/threaded · Note