Lucene search

[email protected]CVE-2007-6386

HistoryDec 15, 2007 - 2:46 a.m.

CVE-2007-6386

2007-12-1502:46:00

CWE-119

[email protected]

web.nvd.nist.gov

cve-2007-6386

buffer overflow

pccscan.dll

trend micro

antivirus

antispyware

internet security

denial of service

privilege escalation

zip archive

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

7 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.8%

JSON

Stack-based buffer overflow in PccScan.dll before build 1451 in Trend Micro AntiVirus plus AntiSpyware 2008, Internet Security 2008, and Internet Security Pro 2008 allows user-assisted remote attackers to cause a denial of service (SfCtlCom.exe crash), and allows local users to gain privileges, via a malformed .zip archive with a long name, as demonstrated by a .zip file created via format string specifiers in a crafted .uue file.

Affected configurations

NVD

Node

trend_microtrend_micro_antivirus_plus_antispywareMatch2008bld_1450

trend_microtrend_micro_internet_security__virus_bustMatch2008bld_1451

trend_microtrend_micro_internet_security_pro

CPENameOperatorVersion
trend_micro:trend_micro_antivirus_plus_antispywaretrend micro trend micro antivirus plus antispywareeq2008
trend_micro:trend_micro_internet_security_virus_busttrend micro trend micro internet security virus busteq2008
trend_micro:trend_micro_internet_security_protrend micro trend micro internet security proeq*

CPE	Name	Operator	Version
trend_micro:trend_micro_antivirus_plus_antispyware	trend micro trend micro antivirus plus antispyware	eq	2008
trend_micro:trend_micro_internet_security_virus_bust	trend micro trend micro internet security virus bust	eq	2008
trend_micro:trend_micro_internet_security_pro	trend micro trend micro internet security pro	eq	*

References

esupport.trendmicro.com/support/viewxml.do?ContentID=1036464

osvdb.org/39769

osvdb.org/39770

secunia.com/advisories/28038

secway.org/advisory/AD20071211.txt

www.securitytracker.com/id?1019079

www.vupen.com/english/advisories/2007/4191

exchange.xforce.ibmcloud.com/vulnerabilities/38982

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

7 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.8%

JSON

Related for CVE-2007-6386

prion1 cvelist1 nvd1