Test ID:	1.3.6.1.4.1.25623.1.0.900205
Category:	Privilege escalation
Title:	Trend Micro Web Management Authentication Bypass Vulnerability
Summary:	Trend Micro OfficeScan is prone to an authentication bypass vulnerability.
Description:	Summary: Trend Micro OfficeScan is prone to an authentication bypass vulnerability. Vulnerability Insight: The flaw is due to insufficient entropy in a random session token used to identify an authenticated manager using the web console. Vulnerability Impact: Remote users can gain administrative access on the target application and allow arbitrary code execution. Affected Software/OS: Trend Micro Client Server Messaging Security (CSM) versions 3.5 and 3.6 Trend Micro OfficeScan Corporate Edition versions 7.0 and 7.3 Trend Micro OfficeScan Corporate Edition version 8.0 Trend Micro Worry-Free Business Security (WFBS) version 5.0 Solution: Partially Fixed. Fix is available for Trend Micro OfficeScan 8.0 and Worry-Free Business Security 5.0. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2008-2433 BugTraq ID: 30792 http://www.securityfocus.com/bid/30792 Bugtraq: 20080822 Secunia Research: Trend Micro Products Web Management Authentication Bypass (Google Search) http://www.securityfocus.com/archive/1/495670/100/0/threaded http://secunia.com/secunia_research/2008-31/advisory/ http://www.securitytracker.com/id?1020732 http://secunia.com/advisories/31373 http://securityreason.com/securityalert/4191 http://www.vupen.com/english/advisories/2008/2421 XForce ISS Database: trend-micro-token-security-bypass(44597) https://exchange.xforce.ibmcloud.com/vulnerabilities/44597
Copyright	Copyright (C) 2008 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.