Trend Micro OfficeScan CGI Directory Insufficient Permissions Vulnerability

Bugtraq ID:	6616
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 15 2003 12:00AM
Updated:	Jan 15 2003 12:00AM
Credit:	Discovery of this vulnerability credited to Rod Boron <[email protected]>.
Vulnerable:	Trend Micro Virus Buster Corporate Edition 3.54 - Microsoft Windows 2000 Server Japanese Edition Trend Micro Virus Buster Corporate Edition 3.53 - Microsoft Windows 2000 Server Japanese Edition Trend Micro Virus Buster Corporate Edition 3.52 - Microsoft Windows 2000 Server Japanese Edition Trend Micro OfficeScan Corporate Edition for Windows NT Server 3.13 - Microsoft Windows NT 4.0 Trend Micro OfficeScan Corporate Edition for Windows NT Server 3.11 - Microsoft Windows NT 4.0 Trend Micro OfficeScan Corporate Edition for Windows NT Server 3.5 - Microsoft Windows NT 4.0 Trend Micro OfficeScan Corporate Edition for Windows NT Server 3.1.1 - Microsoft Windows NT 4.0 Trend Micro OfficeScan Corporate Edition for Windows NT Server 3.0 - Microsoft Windows NT 4.0 Trend Micro OfficeScan Corporate Edition 3.54 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Novell Netware 5.1 - Novell Netware 5.0 - Novell Netware 4.11 - Novell Netware 4.1 - Novell Netware 3.1.2 Trend Micro OfficeScan Corporate Edition 3.13 - Microsoft Windows 3.1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 - Novell Netware 4.11 - Novell Netware 4.1 Trend Micro OfficeScan Corporate Edition 3.11 - Microsoft Windows 3.1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 - Novell Netware 4.11 - Novell Netware 4.1 Trend Micro OfficeScan Corporate Edition 3.5 - Microsoft Windows 3.1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 - Novell Netware 4.11 - Novell Netware 4.1 Trend Micro OfficeScan Corporate Edition 3.0 - Microsoft Windows 3.1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 - Novell Netware 4.11 - Novell Netware 4.1
Not Vulnerable:

Trend Micro OfficeScan CGI Directory Insufficient Permissions Vulnerability

A vulnerability has been reported for Trend Micro OfficeScan that may allow attackers to access programs residing in the cgi directory of the OfficeScan installation.

Trend Micro OfficeScan CGI Directory Insufficient Permissions Vulnerability

The following proof of concept was provided:

http://x.x.x.x/officescan/cgi/cgiMasterPwd.exe

Trend Micro OfficeScan CGI Directory Insufficient Permissions Vulnerability

Solution:
A tool (CGI_NTFS.exe) is provided with OfficeScan which provides utilities to lock down CGI directory permissions and secure OfficeScan.

Further details about this tool can be found at the following location:

http://kb.trendmicro.com/solutions/solutionDetail.asp?solutionId=13353

Trend Micro OfficeScan CGI Directory Insufficient Permissions Vulnerability

References:

• Solution 13353 (Trend Micro)
  
• Trend Micro OfficeScan Product Homepage (Trend Micro)