PT-2006-5947 · Trend Micro · Trend Micro Officescan+2

Published 2006-10-09 · Updated 2011-03-08 · CVE-2006-5212

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Trend Micro OfficeScan versions 6.0 through 6.0.0.1384 Trend Micro OfficeScan Corporate Edition (OSCE) versions 6.5 through 6.5.0.1417 Trend Micro OfficeScan Corporate Edition (OSCE) versions 7.0 through 7.0.0.1256 Trend Micro OfficeScan Corporate Edition (OSCE) versions 7.3 through 7.3.0.1052

Description The issue allows remote attackers to delete files by modifying the filename parameter in a certain HTTP request. This request invokes the OfficeScan CGI program, enabling unauthorized file deletion.

Recommendations For Trend Micro OfficeScan version 6.0, update to version 6.0.0.1385 or later. For Trend Micro OfficeScan Corporate Edition (OSCE) version 6.5, update to version 6.5.0.1418 or later. For Trend Micro OfficeScan Corporate Edition (OSCE) version 7.0, update to version 7.0.0.1257 or later. For Trend Micro OfficeScan Corporate Edition (OSCE) version 7.3, update to version 7.3.0.1053 or later.

Fix

Related Identifiers

CVE-2006-5212

Affected Products

Trend Micro Officescan

Trend Micro Officescan Corporate Edition

Trend Micro Officescan Server

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2006-5212 · Security Note
• http://trendmicro.com/ftp/documentation/readme/osce_6.5_win_en_securitypatch_1418_readme.txt · Vendor Advisory
• http://trendmicro.com/ftp/documentation/readme/osce_70_win_en_securitypatch_1257_readme.txt · Vendor Advisory
• http://trendmicro.com/download/product.asp?productid=5 · Patch
• http://secunia.com/advisories/22156 · Vendor Advisory
• http://trendmicro.com/ftp/documentation/readme/osce_7.3_win_en_securitypatch_1053_readme.txt · Vendor Advisory
• http://trendmicro.com/ftp/documentation/readme/csm_2.0_osce_6.0_win_en_securitypatch_1385_readme.txt · Vendor Advisory
• http://vupen.com/english/advisories/2006/3882 · Note
• http://securityfocus.com/bid/20330 · Note
• http://frsirt.com/english/advisories/2006/3882 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5212 · Note