PT-2008-2955 · Trend Micro · Trend Micro Officescan Corporate Edition+1
Luigi Auriemma
·
Published
2008-03-17
·
Updated
2011-03-08
·
CVE-2008-1365
CVSS v2.0
6.4
Medium
| Vector | AV:N/AC:L/Au:N/C:N/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Trend Micro OfficeScan Corporate Edition versions 7.3 Patch 3 build 1314 and earlier
Trend Micro OfficeScan Corporate Edition versions 8.0 Patch 2 build 1189 and earlier
Description
The issue is a stack-based buffer overflow that allows remote attackers to execute arbitrary code or cause a denial of service via a long encrypted password. This overflow can be triggered in
cgiChkMasterPwd.exe, policyserver.exe as reachable through cgiABLogon.exe, and other vectors.Recommendations
For Trend Micro OfficeScan Corporate Edition versions 7.3 Patch 3 build 1314 and earlier, update to a version later than 7.3 Patch 3 build 1314 to resolve the issue.
For Trend Micro OfficeScan Corporate Edition versions 8.0 Patch 2 build 1189 and earlier, update to a version later than 8.0 Patch 2 build 1189 to resolve the issue.
As a temporary workaround, consider restricting access to
cgiChkMasterPwd.exe and policyserver.exe to minimize the risk of exploitation.Exploit
Fix
RCE
DoS
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Trend Micro Officescan Corporate Edition
Trend Micro Officescan Server