PT-2009-1215 · Trend Micro · Trend Micro Officescan+2

Published 2009-01-21 · Updated 2017-08-08 · CVE-2008-3866

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Trend Micro OfficeScan version 8.0 SP1 Patch 1 Trend Micro Internet Security versions 2007 and 2008 17.0.1224

Description The issue allows local users to bypass intended access restrictions and change firewall settings by sending crafted packets using a modified client. This is due to the reliance on client-side password protection implemented in the configuration GUI of the Trend Micro Personal Firewall service.

Recommendations For Trend Micro OfficeScan version 8.0 SP1 Patch 1, consider restricting access to the configuration GUI to minimize the risk of exploitation. For Trend Micro Internet Security versions 2007 and 2008 17.0.1224, avoid using the modified client to send crafted packets until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2008-3866

Affected Products

Trend Micro Internet Security

Trend Micro Officescan

Trend Micro Personal Firewall

References · 11

• http://secunia.com/advisories/31160 · Vendor Advisory
• http://secunia.com/secunia_research/2008-43 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3866 · Security Note
• http://secunia.com/advisories/33609 · Vendor Advisory
• http://securityfocus.com/bid/33358 · Patch
• http://trendmicro.com/ftp/documentation/readme/OSCE8.0_SP1_Patch1_CriticalPatch_3191_Readme.txt · Vendor Advisory
• http://securitytracker.com/id?1021616 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48108 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3866 · Note
• http://securitytracker.com/id?1021617 · Note
• http://vupen.com/english/advisories/2009/0191 · Note