CVE-2007-1070
Summary
| CVE | CVE-2007-1070 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2007-02-21 11:28:00 UTC |
| Updated | 2018-10-16 16:36:00 UTC |
| Description | Multiple stack-based buffer overflows in Trend Micro ServerProtect for Windows and EMC 5.58, and for Network Appliance Filer 5.61 and 5.62, allow remote attackers to execute arbitrary code via crafted RPC requests to TmRpcSrv.dll that trigger overflows when calling the (1) CMON_NetTestConnection, (2) CMON_ActiveUpdate, and (3) CMON_ActiveRollback functions in (a) StCommon.dll, and (4) ENG_SetRealTimeScanConfigInfo and (5) ENG_SendEMail functions in (b) eng50.dll. |
Risk And Classification
Problem Types: NVD-CWE-Other
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Microsoft | Windows 2000 | All | All | All | All |
| Operating System | Microsoft | Windows 2000 | All | All | All | All |
| Operating System | Microsoft | Windows 2003 Server | r2 | All | All | All |
| Operating System | Microsoft | Windows 2003 Server | sp2 | All | All | All |
| Operating System | Microsoft | Windows 2003 Server | r2 | All | All | All |
| Operating System | Microsoft | Windows 2003 Server | sp2 | All | All | All |
| Operating System | Microsoft | Windows Nt | All | All | All | All |
| Operating System | Microsoft | Windows Nt | All | All | All | All |
| Operating System | Microsoft | Windows Vista | All | All | 32_bit | All |
| Operating System | Microsoft | Windows Vista | All | All | 32_bit | All |
| Operating System | Microsoft | Windows Xp | All | gold | All | All |
| Operating System | Microsoft | Windows Xp | All | gold | All | All |
| Application | Trend Micro | Serverprotect | 5.58 | All | emc | All |
| Application | Trend Micro | Serverprotect | 5.61 | All | network_appliance_filer | All |
| Application | Trend Micro | Serverprotect | 5.62 | All | network_appliance_filer | All |
| Application | Trend Micro | Serverprotect | 5.58 | All | emc | All |
| Application | Trend Micro | Serverprotect | 5.61 | All | network_appliance_filer | All |
| Application | Trend Micro | Serverprotect | 5.62 | All | network_appliance_filer | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| 33042 | OSVDB | osvdb.org | |
| Trend Micro ServerProtect Buffer Overflow Vulnerabilities - Advisories - Secunia | SECUNIA | secunia.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | VUPEN | www.vupen.com | |
| US-CERT Vulnerability Notes | CERT-VN | www.kb.cert.org | US Government Resource |
| [Vulnerability Response] Buffer overflow in ServerProtect [EN-1034290] | CONFIRM | esupport.trendmicro.com | Patch, Vendor Advisory |
| www.trendmicro.com/ftp/documentation/readme/spnt_558_win_en_securitypatch1_readm... | CONFIRM | www.trendmicro.com | Vendor Advisory |
| Trend Micro ServerProtect Stack Overflow in CMON_NetTestConnection() Lets Remote Users Execute Arbitrary Code - SecurityTracker | SECTRACK | www.securitytracker.com | |
| SecurityFocus | BUGTRAQ | www.securityfocus.com | |
| US-CERT Vulnerability Notes | CERT-VN | www.kb.cert.org | US Government Resource |
| Enterprise Intrusion Prevention (IPS) Software & Solutions | Trend Micro | MISC | www.tippingpoint.com | Vendor Advisory |
| US-CERT Vulnerability Note VU#630025 | CERT-VN | www.kb.cert.org | US Government Resource |
| Trend Micro ServerProtect SPNTSVC.EXE Multiple Stack Buffer Overflow Vulnerabilities | BID | www.securityfocus.com | |
| IBM X-Force Exchange | XF | exchange.xforce.ibmcloud.com | |
| US-CERT Vulnerability Notes | CERT-VN | www.kb.cert.org | US Government Resource |
| IBM X-Force Exchange | XF | exchange.xforce.ibmcloud.com | |
| Enterprise Intrusion Prevention (IPS) Software & Solutions | Trend Micro | MISC | www.tippingpoint.com | Vendor Advisory |
| SecurityFocus | BUGTRAQ | www.securityfocus.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.