PT-2007-4726 · Trend Micro · Trend Micro Officescan Corporate Edition+1

Published 2007-06-26 · Updated 2017-07-29 · CVE-2007-3455

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Trend Micro OfficeScan Corporate Edition versions prior to 8.0.0.142

Description The issue allows remote attackers to bypass the password requirement and gain access to the Management Console. This can be achieved via an empty hash and empty encrypted password string or through crafted HTTP headers. The problem is related to stored decrypted user logon information.

Recommendations For versions prior to 8.0.0.142, update to version 8.0.0.142 or later to resolve the issue. As a temporary workaround, consider restricting access to the Management Console to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2007-3455

Affected Products

Trend Micro Officescan Corporate Edition

Trend Micro Officescan Server

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2007-3455 · Security Note
• http://secunia.com/advisories/25778 · Vendor Advisory
• http://trendmicro.com/ftp/documentation/readme/osce_80_win_en_securitypatch_b1042_readme.txt · Patch
• http://securitytracker.com/id?1018320 · Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=558 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3455 · Note
• http://vupen.com/english/advisories/2007/2330 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35052 · Note
• http://frsirt.com/english/advisories/2007/2330 · Note
• http://securityfocus.com/bid/24641 · Note
• http://securityfocus.com/bid/24935 · Note
• http://osvdb.org/36628 · Note