CVE-2008-2433

CVE-2008-2433 affects Trend Micro OfficeScan 7.0–8.0, Worry-Free Business Security 5.0, and Client/Server/Messaging Suite 3.5–3.6. The root cause is insufficient entropy in the web management console’s session token generation, which relies only on login time (granularity of one second). This wea...

CVE-2008-2433: Use of Insufficiently Random Values

The web management console in Trend Micro OfficeScan 7.0 through 8.0, Worry-Free Business Security 5.0, and Client/Server/Messaging Suite 3.5 and 3.6 creates a random session token based only on the login time, which makes it easier for remote attackers to hijack sessions via brute-force attacks...