CVE-2008-3866

2009-01-2120:30:00

CWE-287

[email protected]

web.nvd.nist.gov

trend micro

personal firewall

tmpfw.exe

network security component

cve-2008-3866

vulnerability

access restrictions

configuration gui

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

6.5 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

The Trend Micro Personal Firewall service (aka TmPfw.exe) in Trend Micro Network Security Component (NSC) modules, as used in Trend Micro OfficeScan 8.0 SP1 Patch 1 and Internet Security 2007 and 2008 17.0.1224, relies on client-side password protection implemented in the configuration GUI, which allows local users to bypass intended access restrictions and change firewall settings by using a modified client to send crafted packets.

Affected configurations

NVD

Node

trend_microinternet_security_2007

trend_microinternet_security_2008Match17.0.1224

trend_microofficescanMatch8.0sp1

CPENameOperatorVersion
trend_micro:internet_security_2007trend micro internet security 2007eq*
trend_micro:internet_security_2008trend micro internet security 2008eq17.0.1224
trend_micro:officescantrend micro officescaneq8.0

CPE	Name	Operator	Version
trend_micro:internet_security_2007	trend micro internet security 2007	eq	*
trend_micro:internet_security_2008	trend micro internet security 2008	eq	17.0.1224
trend_micro:officescan	trend micro officescan	eq	8.0