OSVDB ID: 48730

Title: Trend Micro OfficeScan OfficeScanNT Listener Traversal Arbitrary File Access

Info

Disclosure
Sep 30, 2008

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Sep 30, 2008

Description

 Trend Micro OfficeScan contains a flaw that may lead to an unauthorized information disclosure.  The issue is triggered when sending a HTTP GET request containing dot dot slash directory traversal, which will disclose arbitrary files as the SYSTEM account, resulting in a loss of confidentiality.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Confidentiality
Solution: Patch / RCS
Exploit: Exploit Public
Disclosure: OSVDB Verified, Vendor Verified
OSVDB: Security Software

Solution

 Currently, there are no known workarounds or upgrades to correct this issue. However, TrendMicro has released a patch to address this vulnerability.

Products

Trend Micro, Inc.

OfficeScan Corporate Edition

 7.3 Patch 4 build 1367
8.0 SP1 build 1221
8.0 SP1 Patch 1 before build 3086
7.3 Patch 4 build 1367
8.0 SP1 build 1221
8.0 SP1 Patch 1 before build 3086

Worry-Free Business Security

 5.0
5.0

References

Credit
  • Dyon Balding - Secunia
  • Dyon Balding - Secunia


Direct URL: http://osvdb.org/48730