Trend Micro OfficeScan multiple security vulnerabilities
Published:		19.07.2007
Source:		BUGTRAQ
SecurityVulns ID:		7946
Type:		remote
Level:		7/10
Description:		Unauthorized access to administration interface, buffer overflow on session cookie parsing.

Affected:		TM : OfficeScan 7.3
		TM : Trend Micro Client Server Messaging Security 3.6
		TM : OfficeScan 8.0
CVE:		CVE-2007-3455 (cgiChkMasterPwd.exe before 8.0.0.142 in Trend Micro OfficeScan Corporate Edition 8.0 allows remote attackers to bypass the password requirement and gain access to the Management Console via an empty hash and empty encrypted password string, related to "stored decrypted user logon information.")
		CVE-2007-3454 (Stack-based buffer overflow in CGIOCommon.dll before 8.0.0.1042 in Trend Micro OfficeScan Corporate Edition 8.0 allows remote attackers to execute arbitrary code via long crafted requests, as demonstrated using a long session cookie to unspecified CGI programs that use this library.)

Original document		IDEFENSE, iDefense Security Advisory 07.16.07: Trend Micro OfficeScan Management Console Authorization Bypass Vulnerability (19.07.2007)
		IDEFENSE, iDefense Security Advisory 07.16.07: Trend Micro OfficeScan Session Cookie Buffer Overflow Vulnerability (19.07.2007)

Discuss:

Read or add your comments to this news (0 comments)