PT-2008-3905 · Trend Micro · Trend Micro Client / Server / Messaging Security+2

Published 2008-09-16 · Updated 2018-10-11 · CVE-2008-2437

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Trend Micro OfficeScan versions 7.3 patch 4 build 1362 and other builds, 8.0, 8.0 SP1 Trend Micro Client Server Messaging Security version 3.6

Description: The issue is a stack-based buffer overflow that allows remote attackers to execute arbitrary code via an HTTP request containing a long ComputerName parameter.

Recommendations: For Trend Micro OfficeScan versions 7.3 patch 4 build 1362 and other builds, 8.0, 8.0 SP1, consider restricting access to the cgiRecvFile.exe until a patch is available. For Trend Micro Client Server Messaging Security version 3.6, avoid using long ComputerName parameters in HTTP requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2008-2437

Affected Products

Trend Micro Client / Server / Messaging Security

Trend Micro Officescan

Trend Micro Officescan Server

References · 15

• http://secunia.com/secunia_research/2008-35 · Vendor Advisory
• http://securityfocus.com/bid/31139 · Patch
• http://secunia.com/advisories/31342 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2437 · Security Note
• http://vupen.com/english/advisories/2008/2555 · Note
• http://securityfocus.com/archive/1/496281/100/0/threaded · Note
• http://securitytracker.com/id?1020860 · Note
• http://trendmicro.com/ftp/documentation/readme/OSCE_7.3_Win_EN_CriticalPatch_B1367_readme.txt · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45072 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2437 · Note
• http://securityreason.com/securityalert/4263 · Note
• http://trendmicro.com/ftp/documentation/readme/OSCE_8.0_SP1_Win_EN_CriticalPatch_B2424_readme.txt · Note
• http://trendmicro.com/ftp/documentation/readme/OSCE_8.0_Win_EN_CriticalPatch_B1361_readme.txt · Note
• http://trendmicro.com/ftp/documentation/readme/OSCE_8.0_SP1_Patch1_Win_EN_CriticalPatch_B3060_readme.txt · Note
• http://trendmicro.com/ftp/documentation/readme/CSM_3.6_OSCE_7.6_Win_EN_CriticalPatch_B1195_readme.txt · Note