Trend Micro OfficeScan Local Privilege Escalation Vulnerability

Bugtraq ID:	10503
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Jun 09 2004 12:00AM
Updated:	Jun 09 2004 12:00AM
Credit:	This issue was reported by Donald Reid <[email protected]>.
Vulnerable:	Trend Micro OfficeScan Corporate Edition 5.58 Trend Micro OfficeScan Corporate Edition 5.5 Trend Micro OfficeScan Corporate Edition 5.0 2 Trend Micro OfficeScan Corporate Edition 3.54 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Novell Netware 5.1 - Novell Netware 5.0 - Novell Netware 4.11 - Novell Netware 4.1 - Novell Netware 3.1.2 Trend Micro OfficeScan Corporate Edition 3.13 - Microsoft Windows 3.1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 - Novell Netware 4.11 - Novell Netware 4.1 Trend Micro OfficeScan Corporate Edition 3.11 - Microsoft Windows 3.1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 - Novell Netware 4.11 - Novell Netware 4.1 Trend Micro OfficeScan Corporate Edition 3.5 - Microsoft Windows 3.1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 - Novell Netware 4.11 - Novell Netware 4.1 Trend Micro OfficeScan Corporate Edition 3.0 - Microsoft Windows 3.1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 - Novell Netware 4.11 - Novell Netware 4.1
Not Vulnerable:

Trend Micro OfficeScan Local Privilege Escalation Vulnerability

OfficeScan is prone to a local privilege escalation vulnerability. This issue can allow a local attacker to execute arbitrary applications and escalate privileges.

Trend Micro OfficeScan versions 5.58 and prior are affected by this issue.

Trend Micro OfficeScan Local Privilege Escalation Vulnerability

No exploit is required.

Trend Micro OfficeScan Local Privilege Escalation Vulnerability

Solution:
The vendor has released a patch to address this issue in computers running OfficeScan 5.58. This patch may not be entirely effective against shatter style attacks. Please contact the vendor to obtain the patch.

Trend Micro OfficeScan Local Privilege Escalation Vulnerability

References:

• Solution #20118 (Trend Micro)
  
• Trend Officescan local privilege escalation ("Donald Reid" )