PT-2007-2595 · Trend Micro · Trend Micro Serverprotect For Linux

Published 2007-02-28 · Updated 2011-03-08 · CVE-2007-1168

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Trend Micro ServerProtect for Linux (SPLX) versions 1.25, 1.3, and 2.5 before 20070216

Description The issue allows remote attackers to access arbitrary web pages and reconfigure the product via HTTP requests with the splx 2376 info cookie to the web interface port (14942/tcp).

Recommendations For versions 1.25, 1.3, and 2.5 before 20070216, consider restricting access to the web interface port 14942/tcp until a fix is applied. As a temporary workaround, avoid using the splx 2376 info cookie in HTTP requests to the web interface until the issue is resolved.

Fix

Related Identifiers

CVE-2007-1168

Affected Products

Trend Micro Serverprotect For Linux

References · 8

• http://secunia.com/advisories/24264 · Vendor Advisory
• http://securityfocus.com/bid/22662 · Patch
• http://securitytracker.com/id?1017685 · Patch
• http://trendmicro.com/download/product.asp?productid=20 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-1168 · Security Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=477 · Vendor Advisory
• http://vupen.com/english/advisories/2007/0691 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1168 · Note