CERTA-2007-AVI-210
Vulnerability from certfr_avis
Des vulnérabilités sur Trend Micro ServerProtect permettent à une personne malintentionnée distante d'exécuter du code arbitraire.
Description
Des vulnérabilités de type débordement de mémoire ont été identifiées sur Trend Micro ServerProtect. Les modules concernés sont stcommon.dll, stcommon.dll, eng50.dll, earthagent.exe, et AgRpcCln.dll. Ces fichiers appellent des fonctions ne gérant pas correctement certains messages RPC spécialement construits. Un attaquant exploitant l'une de ces vulnérabilités pourrait exécuter du code arbitraire à distance.
Solution
Les mises à jour Security Patch 2 et Security Patch 3 de l'éditeur corrigent ces vulnérabilités.
Trend Micro ServerProtect versions 5.58 et antérieures sur Microsoft Windows.
Impacted products
| Vendor | Product | Description |
|---|
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [],
"affected_systems_content": "\u003cP\u003eTrend Micro ServerProtect versions 5.58 et ant\u00e9rieures sur Microsoft Windows.\u003c/P\u003e",
"content": "## Description\n\nDes vuln\u00e9rabilit\u00e9s de type d\u00e9bordement de m\u00e9moire ont \u00e9t\u00e9 identifi\u00e9es\nsur Trend Micro ServerProtect. Les modules concern\u00e9s sont stcommon.dll,\nstcommon.dll, eng50.dll, earthagent.exe, et AgRpcCln.dll. Ces fichiers\nappellent des fonctions ne g\u00e9rant pas correctement certains messages RPC\nsp\u00e9cialement construits. Un attaquant exploitant l\u0027une de ces\nvuln\u00e9rabilit\u00e9s pourrait ex\u00e9cuter du code arbitraire \u00e0 distance.\n\n## Solution\n\nLes mises \u00e0 jour Security Patch 2 et Security Patch 3 de l\u0027\u00e9diteur\ncorrigent ces vuln\u00e9rabilit\u00e9s.\n",
"cves": [
{
"name": "CVE-2007-2508",
"url": "https://www.cve.org/CVERecord?id=CVE-2007-2508"
},
{
"name": "CVE-2007-2528",
"url": "https://www.cve.org/CVERecord?id=CVE-2007-2528"
}
],
"initial_release_date": "2007-05-09T00:00:00",
"last_revision_date": "2007-05-09T00:00:00",
"links": [
{
"title": "R\u00e9f\u00e9rence CVE CVE-2007-2508 :",
"url": "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2508"
},
{
"title": "R\u00e9f\u00e9rence CVE CVE-2007-2528 :",
"url": "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2528"
},
{
"title": "Mises \u00e0 jour pour Trend Micro ServerProtect :",
"url": "http://www.trendmicro.com/download_beta/product.asp?productid=17"
}
],
"reference": "CERTA-2007-AVI-210",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2007-05-09T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
}
],
"summary": "Des vuln\u00e9rabilit\u00e9s sur \u003cspan class=\"textit\"\u003eTrend Micro\nServerProtect\u003c/span\u003e permettent \u00e0 une personne malintentionn\u00e9e distante\nd\u0027ex\u00e9cuter du code arbitraire.\n",
"title": "Vuln\u00e9rabilit\u00e9s dans Trend Micro ServerProtect",
"vendor_advisories": [
{
"published_at": null,
"title": "Mises \u00e0 jour de Trend Micro ServerProtect",
"url": null
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…