Bugtraq mailing list archives
[SNS Advisory No.38] Trend Micro Virus Buster (Ver.3.5x) Remote File Disclosure With IUSER Privilege Vulnerability
From: "snsadv () lac co jp" <snsadv () lac co jp>
Date: Wed, 22 Aug 2001 05:09:07 +0900
---------------------------------------------------------------------- SNS Advisory No.38 Trend Micro Virus Buster (Ver.3.5x) Remote File Disclosure With IUSER Privilege Vulnerability Problem first discovered: Wed, 18 Jul 2001 Published: Mon, 20 Aug 2001 ---------------------------------------------------------------------- Overview: --------- Trend Micro Virus Buster (a.k.a Officescan Corporate Edition) contains a vulnerability which allows attacker to read arbitrary files with IUSER privilege. Problem Description: -------------------- Trend Micro Virus Buster is antivirus software for the enterprise use. It provides central virus reporting, automatic virus pattern updates, and Web-based remote management console. A vulnerability lies in cgiWebupdate.exe, which is one of the CGI programs which used for remote management. This problem can allow remote users to read arbitrary files with IUSER privilege. "Virus Buster Corporate Edition" is provided only as Japanese version which is a.k.a "Officescan Corporate Edition" as English version. We're still working with Trend Micro about this problem in "Officescan Corporate Edition". As soon as possible, we will publish the issue. Tested Version: --------------- Trend Micro Virus Buster Corporate Edition Version 3.52 Trend Micro Virus Buster Corporate Edition Version 3.53 Trend Micro Virus Buster Corporate Edition Version 3.54 Tested OS: ---------- Windows 2000 Server [Japanese] Patch Information: ------------------ The patch is available from the following site: http://www.trendmicro.co.jp/esolution/solutionDetail.asp?solutionId=3086 Discovered by: -------------- Nobuo Miwa (LAC / n-miwa () lac co jp) Disclaimer: ----------- All information in these advisories are subject to change without any advanced notices neither mutual consensus, and each of them is released as it is. LAC Co., Ltd. is not responsible for any risks of occurrences caused by applying those information. References ---------- Archive of this advisory(in preparation now): http://www.lac.co.jp/security/english/snsadv_e/38_e.html ------------------------------------------------------------------ Secure Net Service(SNS) Security Advisory <snsadv () lac co jp> Computer Security Laboratory, LAC http://www.lac.co.jp/security/
Current thread:
- [SNS Advisory No.38] Trend Micro Virus Buster (Ver.3.5x) Remote File Disclosure With IUSER Privilege Vulnerability snsadv () lac co jp (Aug 21)