CVE-2007-4277 - Vulnerability Details - OpenCVE

The Trend Micro AntiVirus scan engine before 8.550-1001, as used in Trend Micro PC-Cillin Internet Security 2007, and Tmxpflt.sys 8.320.1004 and 8.500.0.1002, has weak permissions (Everyone:Write) for the \\.\Tmfilter device, which allows local users to send arbitrary content to the device via the IOCTL functionality. NOTE: this can be leveraged for privilege escalation by exploiting a buffer overflow in the handler for IOCTL 0xa0284403.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Trend Micro	Pc-cillin Internet Security 2007 Scan Engine

Configuration 1 [-]

OR	cpe:2.3:a:trend_micro:pc-cillin_internet_security_2007::::::::
	cpe:2.3:a:trend_micro:scan_engine::::::::

No data.

References

Link	Providers
http://esupport.trendmicro.com/support/viewxml.do?ContentID=1035793
http://esupport.trendmicro.com/support/viewxml.do?ContentID=1036190
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=609
http://secunia.com/advisories/27378
http://securitytracker.com/id?1018863
http://www.securityfocus.com/bid/26209
http://www.vupen.com/english/advisories/2007/3627

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-10-30T22:00:00

Updated: 2024-08-07T14:46:39.426Z

Reserved: 2007-08-09T00:00:00

Link: CVE-2007-4277

Vulnrichment

No data.

NVD

Status : Modified

Published: 2007-10-30T22:46:00.000

Modified: 2024-11-21T00:35:12.867

Link: CVE-2007-4277

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-10-25T00:00:00", "descriptions": [{"lang": "en", "value": "The Trend Micro AntiVirus scan engine before 8.550-1001, as used in Trend Micro PC-Cillin Internet Security 2007, and Tmxpflt.sys 8.320.1004 and 8.500.0.1002, has weak permissions (Everyone:Write) for the \\\\.\\Tmfilter device, which allows local users to send arbitrary content to the device via the IOCTL functionality. NOTE: this can be leveraged for privilege escalation by exploiting a buffer overflow in the handler for IOCTL 0xa0284403."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2007-11-07T10:00:00", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "27378", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/27378"}, {"name": "26209", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/26209"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://esupport.trendmicro.com/support/viewxml.do?ContentID=1035793"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://esupport.trendmicro.com/support/viewxml.do?ContentID=1036190"}, {"name": "1018863", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://securitytracker.com/id?1018863"}, {"name": "20071025 Trend Micro Tmxpflt.sys IOCTL 0xa0284403 Buffer Overflow Vulnerability", "tags": ["third-party-advisory", "x_refsource_IDEFENSE"], "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=609"}, {"name": "ADV-2007-3627", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2007/3627"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-4277", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Trend Micro AntiVirus scan engine before 8.550-1001, as used in Trend Micro PC-Cillin Internet Security 2007, and Tmxpflt.sys 8.320.1004 and 8.500.0.1002, has weak permissions (Everyone:Write) for the \\\\.\\Tmfilter device, which allows local users to send arbitrary content to the device via the IOCTL functionality. NOTE: this can be leveraged for privilege escalation by exploiting a buffer overflow in the handler for IOCTL 0xa0284403."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "27378", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/27378"}, {"name": "26209", "refsource": "BID", "url": "http://www.securityfocus.com/bid/26209"}, {"name": "http://esupport.trendmicro.com/support/viewxml.do?ContentID=1035793", "refsource": "CONFIRM", "url": "http://esupport.trendmicro.com/support/viewxml.do?ContentID=1035793"}, {"name": "http://esupport.trendmicro.com/support/viewxml.do?ContentID=1036190", "refsource": "CONFIRM", "url": "http://esupport.trendmicro.com/support/viewxml.do?ContentID=1036190"}, {"name": "1018863", "refsource": "SECTRACK", "url": "http://securitytracker.com/id?1018863"}, {"name": "20071025 Trend Micro Tmxpflt.sys IOCTL 0xa0284403 Buffer Overflow Vulnerability", "refsource": "IDEFENSE", "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=609"}, {"name": "ADV-2007-3627", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/3627"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T14:46:39.426Z"}, "title": "CVE Program Container", "references": [{"name": "27378", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/27378"}, {"name": "26209", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/26209"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://esupport.trendmicro.com/support/viewxml.do?ContentID=1035793"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://esupport.trendmicro.com/support/viewxml.do?ContentID=1036190"}, {"name": "1018863", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://securitytracker.com/id?1018863"}, {"name": "20071025 Trend Micro Tmxpflt.sys IOCTL 0xa0284403 Buffer Overflow Vulnerability", "tags": ["third-party-advisory", "x_refsource_IDEFENSE", "x_transferred"], "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=609"}, {"name": "ADV-2007-3627", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2007/3627"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-4277", "datePublished": "2007-10-30T22:00:00", "dateReserved": "2007-08-09T00:00:00", "dateUpdated": "2024-08-07T14:46:39.426Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:trend_micro:pc-cillin_internet_security_2007:*:*:*:*:*:*:*:*", "matchCriteriaId": "2E0ADD32-0809-498D-A9A6-6F7CA0728DC8", "vulnerable": true}, {"criteria": "cpe:2.3:a:trend_micro:scan_engine:*:*:*:*:*:*:*:*", "matchCriteriaId": "04D67EEC-1538-46D3-8865-B41E5DCF7366", "versionEndIncluding": "8.500", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The Trend Micro AntiVirus scan engine before 8.550-1001, as used in Trend Micro PC-Cillin Internet Security 2007, and Tmxpflt.sys 8.320.1004 and 8.500.0.1002, has weak permissions (Everyone:Write) for the \\\\.\\Tmfilter device, which allows local users to send arbitrary content to the device via the IOCTL functionality. NOTE: this can be leveraged for privilege escalation by exploiting a buffer overflow in the handler for IOCTL 0xa0284403."}, {"lang": "es", "value": "La ingenieria de b\u00fasqueda de Trend Micro AntiVirus anterior a 8.550-1001, utilizada en Trend Micro PC-Cillin Internet Security 2007, y Tmxpflt.sys 8.320.1004 y 8.500.0.1002, tiene permisos d\u00e9biles (TODOS:Escritura) para el dispositivo \\\\.\\Tmfilter, lo cual permite a usuarios locales enviar contenido de su elecci\u00f3n al dispositivo a trav\u00e9s de la funcionalidad IOCTL. NOTA: esto podr\u00eda solaparse con una escalada de privilegios a trav\u00e9s de la explotaci\u00f3n de un desbordamiento de b\u00fafer en el manejador para IOCTL 0xa0284403."}], "id": "CVE-2007-4277", "lastModified": "2024-11-21T00:35:12.867", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 6.6, "confidentialityImpact": "NONE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:N/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 9.2, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-10-30T22:46:00.000", "references": [{"source": "cve@mitre.org", "url": "http://esupport.trendmicro.com/support/viewxml.do?ContentID=1035793"}, {"source": "cve@mitre.org", "url": "http://esupport.trendmicro.com/support/viewxml.do?ContentID=1036190"}, {"source": "cve@mitre.org", "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=609"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/27378"}, {"source": "cve@mitre.org", "url": "http://securitytracker.com/id?1018863"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/26209"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2007/3627"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://esupport.trendmicro.com/support/viewxml.do?ContentID=1035793"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://esupport.trendmicro.com/support/viewxml.do?ContentID=1036190"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=609"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/27378"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securitytracker.com/id?1018863"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/26209"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2007/3627"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}