PT-2008-3906 · Trend Micro · Trend Micro Worry-Free Business Security+3
Published
2008-10-03
·
Updated
2018-10-11
·
CVE-2008-2439
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
Trend Micro OfficeScan 7.3 Patch 4 build 1367 through build 1371
Trend Micro OfficeScan 8.0 SP1 before build 1222
Trend Micro OfficeScan 8.0 SP1 Patch 1 before build 3087
Trend Micro Worry-Free Business Security 5.0 before build 1220
Description:
The issue allows remote attackers to read arbitrary files via directory traversal sequences in an HTTP request. This is due to a directory traversal vulnerability in the UpdateAgent function in TmListen.exe in the OfficeScanNT Listener service in the client.
Recommendations:
For Trend Micro OfficeScan 7.3 Patch 4 build 1367 through build 1371, update to a version after build 1371.
For Trend Micro OfficeScan 8.0 SP1 before build 1222, update to build 1222 or later.
For Trend Micro OfficeScan 8.0 SP1 Patch 1 before build 3087, update to build 3087 or later.
For Trend Micro Worry-Free Business Security 5.0 before build 1220, update to build 1220 or later.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Trend Micro Officescan
Trend Micro Officescan Client
Trend Micro Officescan Server
Trend Micro Worry-Free Business Security