PT-2015-6153 · Trend Micro · Trend Micro Scanmail For Exchange

Published 2015-05-14 · Updated 2017-01-03 · CVE-2015-3326

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Trend Micro ScanMail for Microsoft Exchange (SMEX) versions 10.2 before Hot Fix Build 3318 Trend Micro ScanMail for Microsoft Exchange (SMEX) versions 11.0 before Hot Fix Build 4180

Description The issue allows remote attackers to bypass authentication via a brute force attack because the session IDs for the web console are generated using a random number generator with predictable values.

Recommendations For versions 10.2 before Hot Fix Build 3318, apply Hot Fix Build 3318 to resolve the issue. For versions 11.0 before Hot Fix Build 4180, apply Hot Fix Build 4180 to resolve the issue.

Fix

Related Identifiers

CVE-2015-3326

Affected Products

Trend Micro Scanmail For Exchange

References · 6

• http://esupport.trendmicro.com/solution/en-US/1109669.aspx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-3326 · Security Note
• http://securitytracker.com/id/1032323 · Note
• http://blog.malerisch.net/2016/05/trendmicro-smex-session-predictable-cve-2015-3326.html · Note
• http://securityfocus.com/bid/74661 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3326 · Note