PT-2007-5468 · Trend Micro · Trend Micro Pc-Cillin Internet Security+2

Published 2007-10-30 · Updated 2011-03-08 · CVE-2007-4277

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Trend Micro AntiVirus scan engine versions prior to 8.550-1001 Trend Micro PC-Cillin Internet Security 2007 Tmxpflt.sys versions 8.320.1004 and 8.500.0.1002

Description The issue is related to weak permissions for the .Tmfilter device, allowing local users to send arbitrary content via the IOCTL functionality. This can be leveraged for privilege escalation by exploiting a buffer overflow in the handler for IOCTL 0xa0284403.

Recommendations For Trend Micro AntiVirus scan engine versions prior to 8.550-1001, update to version 8.550-1001 or later. For Trend Micro PC-Cillin Internet Security 2007, update the Trend Micro AntiVirus scan engine to version 8.550-1001 or later. For Tmxpflt.sys versions 8.320.1004 and 8.500.0.1002, update Tmxpflt.sys to a version later than 8.500.0.1002. As a temporary workaround, consider restricting access to the .Tmfilter device to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-264

CWE-119

Related Identifiers

CVE-2007-4277

Affected Products

Tmxpflt.Sys

Trend Micro Antivirus Scan Engine

Trend Micro Pc-Cillin Internet Security

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2007-4277 · Security Note
• http://secunia.com/advisories/27378 · Vendor Advisory
• http://vupen.com/english/advisories/2007/3627 · Note
• http://securitytracker.com/id?1018863 · Note
• http://securityfocus.com/bid/26209 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4277 · Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=609 · Note
• http://esupport.trendmicro.com/support/viewxml.do?ContentID=1036190 · Note
• http://esupport.trendmicro.com/support/viewxml.do?ContentID=1035793 · Note