CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS
Percentile
86.9%
A remotely exploitable buffer overflow exists in Trend Micro InterScan WebManager.
InterScan WebManager is an application that inspects http traffic flowing into a network for known malicious code. This application also has the capability to restrict access to adult/unproductive web sites, manage and monitor web usage, monitor and control http traffic, and provide digital certificate revocation checking in SSL connections. If a secure Web siteβs digital certificate has been revoked, InterScan WebManager has the capability to terminate the transaction.
A remotely exploitable buffer overflow exists in the RegGo dynamic link library module included in Trend Micro InterScan WebManager. This module provides management features for the system administrator over an http interface.
Attackers can execute arbitrary code with privileges equivalent to the web server process, typically SYSTEM. Attackers may also be able to inspect and modify all http traffic flowing through the device. Additionally, attackers may be able to disable digital certificate revocation checking in SSL connections thereby allowing access to intentionally malicious websites.
Trend Micro has indicated that this vulnerability has been eliminated in TrendMicro InterScan WebManager version 2.1. Contact Trend Micro for the upgrade.
888283
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Notified: July 12, 2001 Updated: August 15, 2001
Affected
βWe are sorry to inform you that there is a minor bug in Trend Micro InterScan WebManager. We have fixed the bug in the next version of this product, Trend Micro InterScan WebManager version 2.1. The upgrade is now available for testing for customers using the product on English language operating systems. Please contact Trend Micro for download information.β
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23888283 Feedback>).
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
This vulnerability was discovered by Little eArth Corporation Co., Ltd and was made public on July 2, 2001.
This document was written by Ian A. Finlay.
CVE IDs: | CVE-2001-0761 |
---|---|
Severity Metric: | 40.50 Date Public: |