Trend Micro OfficeScan Arbitrary File Disclosure Vulnerability
BID:3216
Info
Trend Micro OfficeScan Arbitrary File Disclosure Vulnerability
| Bugtraq ID: | 3216 |
| Class: | Input Validation Error |
| CVE: |
CVE-2001-1150 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 22 2001 12:00AM |
| Updated: | Jul 11 2009 07:56AM |
| Credit: | This vulnerability was discovered by Nobuo Miwa <[email protected]> and submitted to BugTraq in a SNS Advisory on August 22nd, 2001. |
| Vulnerable: |
Trend Micro Virus Buster Corporate Edition 3.54 Trend Micro Virus Buster Corporate Edition 3.53 Trend Micro Virus Buster Corporate Edition 3.52 Trend Micro OfficeScan Corporate Edition for Windows NT Server 3.5 Trend Micro OfficeScan Corporate Edition 3.54 |
| Not Vulnerable: | |
Discussion
Trend Micro OfficeScan Arbitrary File Disclosure Vulnerability
Trend Micro OfficeScan Corporate Edition is an enterprise-level centrally managed antivirus solution. Virus Buster is the Japanese version of OfficeScan. Both versions are known to be vulnerable to this issue.
Trend Micro Virus Buster/OfficeScan Corporate Edition versions 3.5x are prone to a vulnerability which will allow remote attackers to display arbitrary files(those readable by IUSER, the privileges given to the internet user group and subsequently the application, in Windows NT/2000). The problem exists with one of the software's web management interface programs, which does not prevent attempts to browse the filesystem of the host.
Successful exploitation of this vulnerability may disclose sensitive information to the attacker, which could be used to mount further attacks on the hosts.
Trend Micro OfficeScan Corporate Edition is an enterprise-level centrally managed antivirus solution. Virus Buster is the Japanese version of OfficeScan. Both versions are known to be vulnerable to this issue.
Trend Micro Virus Buster/OfficeScan Corporate Edition versions 3.5x are prone to a vulnerability which will allow remote attackers to display arbitrary files(those readable by IUSER, the privileges given to the internet user group and subsequently the application, in Windows NT/2000). The problem exists with one of the software's web management interface programs, which does not prevent attempts to browse the filesystem of the host.
Successful exploitation of this vulnerability may disclose sensitive information to the attacker, which could be used to mount further attacks on the hosts.
Exploit / POC
Trend Micro OfficeScan Arbitrary File Disclosure Vulnerability
This issue can be exploited with a web browser.
This issue can be exploited with a web browser.
Solution / Fix
Trend Micro OfficeScan Arbitrary File Disclosure Vulnerability
Solution:
A patch has been released for Trend Micro Virus Buster Corporate Edition(the Japanese version of Officescan Corporate Edition).
Trend Micro requests that users contact their local Trend Micro support team for a patch for other language versions of OfficeScan.
Trend Micro Virus Buster Corporate Edition 3.52
Trend Micro Virus Buster Corporate Edition 3.53
Trend Micro Virus Buster Corporate Edition 3.54
Solution:
A patch has been released for Trend Micro Virus Buster Corporate Edition(the Japanese version of Officescan Corporate Edition).
Trend Micro requests that users contact their local Trend Micro support team for a patch for other language versions of OfficeScan.
Trend Micro Virus Buster Corporate Edition 3.52
-
Trend Micro 3086VBC352-3.EXE
http://www.trendmicro.co.jp/esolution/solutionDetail.asp?solutionId=30 86
Trend Micro Virus Buster Corporate Edition 3.53
-
Trend Micro 3086VBC352-3.EXE
http://www.trendmicro.co.jp/esolution/solutionDetail.asp?solutionId=30 86
Trend Micro Virus Buster Corporate Edition 3.54
-
Trend Micro 3086VBC354H2.exe
http://www.trendmicro.co.jp/esolution/solutionDetail.asp?solutionId=30 86
References
Trend Micro OfficeScan Arbitrary File Disclosure Vulnerability
References:
References:
- Trend Micro OfficeScan Product Homepage (Trend Micro)