Trend Micro Virus Control System Information Disclosure Vulnerability

Bugtraq ID:	6618
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 15 2003 12:00AM
Updated:	Jan 15 2003 12:00AM
Credit:	Discovery of this vulnerability credited to Rod Boron <[email protected]>.
Vulnerable:	Trend Micro Virus Control System 1.8 - Microsoft IIS 4.0 - Microsoft IIS 3.0 - Microsoft IIS 2.0 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0
Not Vulnerable:	Trend Micro Control Manager 2.5

Trend Micro Virus Control System Information Disclosure Vulnerability

An information disclosure vulnerability has been reported for TVCS. Reportedly, it is possible for an attacker to access the log files generated by TVCS. The log files contain very sensitive information about the system, including user names and passwords.

Any information obtained in this manner may be used by an attacker to launch further destructive attacks against a system.

Trend Micro Virus Control System Information Disclosure Vulnerability

The following proof of concept was provided:

http://x.x.x.x/tvcs/getservers.exe?action=selects1

Trend Micro Virus Control System Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Trend Micro Virus Control System Information Disclosure Vulnerability

References:

• Trend Micro Control Manager (Trend Micro)