Trend Micro Multiple Products Local Insecure Permissions Vulnerability
BID:15872
Info
Trend Micro Multiple Products Local Insecure Permissions Vulnerability
| Bugtraq ID: | 15872 |
| Class: | Design Error |
| CVE: |
CVE-2005-3360 |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 14 2005 12:00AM |
| Updated: | Mar 22 2006 05:24PM |
| Credit: | The initial discoverer of this issue wishes to remain anonymous. It was disclosed in the referenced iDefense advisory. Dominique GREGOIRE provided information on further products and versions that are affected. |
| Vulnerable: |
Trend Micro PC-Cillin Internet Security 2006 14.10 .1023 Trend Micro PC-Cillin Internet Security 2005 12.0 0 build 1244 Trend Micro PC-Cillin Internet Security 14 14.0.1485 Trend Micro InterScan Messaging Security Suite 5.5 .1183 Trend Micro InterScan Messaging Security Suite 5.5 |
| Not Vulnerable: | |
Discussion
Trend Micro Multiple Products Local Insecure Permissions Vulnerability
Multiple Trend Micro products are susceptible to a local insecure-permissions vulnerability. This issue is due to the applications' failure to ensure that secure permissions are applied to their application and data files.
This issue allows local unprivileged attackers to disable the security features of the affected application, aiding them in further attacks. Attackers may also overwrite arbitrary binaries that will subsequently be executed with SYSTEM-level privileges facilitating the complete compromise of affected computers.
Trend Micro PC-Cillin Internet Security versions 2005 (12.00.1244), 14 (14.00.1485) and 2006 (14.10.0.1023) are affected. Trend Micro InterScan Messaging Security Suite (IMSS) version 5.5 build 1183 is also affected. Other products and versions may also be affected.
Multiple Trend Micro products are susceptible to a local insecure-permissions vulnerability. This issue is due to the applications' failure to ensure that secure permissions are applied to their application and data files.
This issue allows local unprivileged attackers to disable the security features of the affected application, aiding them in further attacks. Attackers may also overwrite arbitrary binaries that will subsequently be executed with SYSTEM-level privileges facilitating the complete compromise of affected computers.
Trend Micro PC-Cillin Internet Security versions 2005 (12.00.1244), 14 (14.00.1485) and 2006 (14.10.0.1023) are affected. Trend Micro InterScan Messaging Security Suite (IMSS) version 5.5 build 1183 is also affected. Other products and versions may also be affected.
Exploit / POC
Trend Micro Multiple Products Local Insecure Permissions Vulnerability
An exploit is not required.
A proof of concept (TmPfw_poc) has been provided by Gerhard Wagner <[email protected]>.
Please replace the TmPfw.exe file with an arbitrary executable, since Symantec isn't adding the shell code included in the proof of concept.
An exploit is not required.
A proof of concept (TmPfw_poc) has been provided by Gerhard Wagner <[email protected]>.
Please replace the TmPfw.exe file with an arbitrary executable, since Symantec isn't adding the shell code included in the proof of concept.
Solution / Fix
Trend Micro Multiple Products Local Insecure Permissions Vulnerability
Solution:
A fix from the vendor is currently pending release. Contact the vendor for further information.
Reportedly, version 5.7.0.1121 of InterScan Messaging Security Suite is not affected by this issue. This has not been confirmed.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Solution:
A fix from the vendor is currently pending release. Contact the vendor for further information.
Reportedly, version 5.7.0.1121 of InterScan Messaging Security Suite is not affected by this issue. This has not been confirmed.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
References
Trend Micro Multiple Products Local Insecure Permissions Vulnerability
References:
References: