CVE-2008-2433 - Secunia Advisories - Vulnerability Information

CVE Reference: CVE-2008-2433
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE: CVE-2008-2433

Description: The web management console in Trend Micro OfficeScan 7.0 through 8.0, Worry-Free Business Security 5.0, and Client/Server/Messaging Suite 3.5 and 3.6 creates a random session token based only on the login time, which makes it easier for remote attackers to hijack sessions via brute-force attacks. NOTE: this can be leveraged for code execution through an unspecified "manipulation of the configuration."

CVE Status: Candidate

References: XF http://xforce.iss.net/xforce/xfdb/44597 ST 1020732 SREASON http://securityreason.com/securityalert/4191 SAID Secunia Advisory: SA31373 MISC http://secunia.com/secunia_research/2008-31/advisory/ CONFIRM http://www.trendmicro.com/ftp/documentation/readme/Readme_WFBS5%200_EN_CriticalPatch1404.txt http://www.trendmicro.com/ftp/documentation/readme/OSCE_8.0_SP1_Win_EN_CriticalPatch_B2402_readme.txt BUGTRAQ http://www.securityfocus.com/archive/1/archive/1/495670/100/0/threaded BID 30792

Return to the previous page.