CVE-2007-0856

2007-02-0818:28:00

[email protected]

web.nvd.nist.gov

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

AI Score

7.1

Confidence

Low

EPSS

0.001

Percentile

25.7%

JSON

TmComm.sys 1.5.0.1052 in the Trend Micro Anti-Rootkit Common Module (RCM), with the VsapiNI.sys 3.320.0.1003 scan engine, as used in Trend Micro PC-cillin Internet Security 2007, Antivirus 2007, Anti-Spyware for SMB 3.2 SP1, Anti-Spyware for Consumer 3.5, Anti-Spyware for Enterprise 3.0 SP2, Client / Server / Messaging Security for SMB 3.5, Damage Cleanup Services 3.2, and possibly other products, assigns Everyone write permission for the \.\TmComm DOS device interface, which allows local users to access privileged IOCTLs and execute arbitrary code or overwrite arbitrary memory in the kernel context.

Affected configurations

Nvd

Node

trend_microclient-server-messaging_securityMatch3.5smb

trend_microdamage_cleanup_servicesMatch3.2

trend_micropc-cillin_internet_securityMatch2007

trend_microtmcomm.sysMatch1.5.1052

trend_microtrend_micro_antirootkit_common_module

trend_microtrend_micro_antispywareMatch3.0_sp2enterprise

trend_microtrend_micro_antispywareMatch3.2_sp1smb

trend_microtrend_micro_antispywareMatch3.5consumer

trend_microtrend_micro_antivirusMatch2007

trend_microvsapini.sysMatch3.320.1003

VendorProductVersionCPE
trend_microclient-server-messaging_security3.5cpe:2.3:a:trend_micro:client-server-messaging_security:3.5:*:smb:*:*:*:*:*
trend_microdamage_cleanup_services3.2cpe:2.3:a:trend_micro:damage_cleanup_services:3.2:*:*:*:*:*:*:*
trend_micropc-cillin_internet_security2007cpe:2.3:a:trend_micro:pc-cillin_internet_security:2007:*:*:*:*:*:*:*
trend_microtmcomm.sys1.5.1052cpe:2.3:a:trend_micro:tmcomm.sys:1.5.1052:*:*:*:*:*:*:*
trend_microtrend_micro_antirootkit_common_module*cpe:2.3:a:trend_micro:trend_micro_antirootkit_common_module:*:*:*:*:*:*:*:*
trend_microtrend_micro_antispyware3.0_sp2cpe:2.3:a:trend_micro:trend_micro_antispyware:3.0_sp2:*:enterprise:*:*:*:*:*
trend_microtrend_micro_antispyware3.2_sp1cpe:2.3:a:trend_micro:trend_micro_antispyware:3.2_sp1:*:smb:*:*:*:*:*
trend_microtrend_micro_antispyware3.5cpe:2.3:a:trend_micro:trend_micro_antispyware:3.5:*:consumer:*:*:*:*:*
trend_microtrend_micro_antivirus2007cpe:2.3:a:trend_micro:trend_micro_antivirus:2007:*:*:*:*:*:*:*
trend_microvsapini.sys3.320.1003cpe:2.3:a:trend_micro:vsapini.sys:3.320.1003:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
trend_micro	client-server-messaging_security	3.5	cpe:2.3:a:trend_micro:client-server-messaging_security:3.5::smb:::::
trend_micro	damage_cleanup_services	3.2	cpe:2.3:a:trend_micro:damage_cleanup_services:3.2:::::::*
trend_micro	pc-cillin_internet_security	2007	cpe:2.3:a:trend_micro:pc-cillin_internet_security:2007:::::::*
trend_micro	tmcomm.sys	1.5.1052	cpe:2.3:a:trend_micro:tmcomm.sys:1.5.1052:::::::*
trend_micro	trend_micro_antirootkit_common_module	*	cpe:2.3:a:trend_micro:trend_micro_antirootkit_common_module::::::::
trend_micro	trend_micro_antispyware	3.0_sp2	cpe:2.3:a:trend_micro:trend_micro_antispyware:3.0_sp2::enterprise:::::
trend_micro	trend_micro_antispyware	3.2_sp1	cpe:2.3:a:trend_micro:trend_micro_antispyware:3.2_sp1::smb:::::
trend_micro	trend_micro_antispyware	3.5	cpe:2.3:a:trend_micro:trend_micro_antispyware:3.5::consumer:::::
trend_micro	trend_micro_antivirus	2007	cpe:2.3:a:trend_micro:trend_micro_antivirus:2007:::::::*
trend_micro	vsapini.sys	3.320.1003	cpe:2.3:a:trend_micro:vsapini.sys:3.320.1003:::::::*