{"vuid":"VU#282240","idnumber":"282240","name":"Trend Micro Anti-Rootkit Common Module fails to properly restrict access to the \"\\\\.\\TmComm\" DOS device interface","keywords":["Trend Micro","privilege escalation","TmComm.sys","\\\\.\\TmComm"],"overview":"A vulnerability exists in Trend Micro's Anti-Rootkit Common Module that may allow a local attacker to gain elevated privileges.","clean_desc":"Trend Micro AntiVirus is a virus scanner for Microsoft Windows and Linux. The Trend Micro Anti-Rootkit Common Module is included with Trend Micro security suites and other anti-virus products. The IOCTL handlers for the DOS device interface included with Trend Micro's Anti-Rootkit Common Module fails to properly validate permissions. Local users are not properly restricted from accessing fucntionality designed for privileged use on the \\\\.\\TmComm DOS device interface.","impact":"A local attacker may be able to execute arbitrary code or overwrite arbitrary memory in the kernel.","resolution":"Apply an update\nTrend Micro has released an update to address this issue.","workarounds":"","sysaffected":"","thanks":"This issue is addressed in Trend Micro solution \n1034432\n. Trend Micro credits \nRuben Santamarta working with the iDefense Contributor Program for reporting this issue.","author":"This document was written by Chris Taschner.","public":["http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=469","http://esupport.trendmicro.com/support/viewxml.do?ContentID=EN-1034432&id=EN-1034432","http://securitytracker.com/alerts/2007/Feb/1017606.html","http://securitytracker.com/alerts/2007/Feb/1017605.html","http://securitytracker.com/alerts/2007/Feb/1017604.html","http://www.securityfocus.com/bid/22448"],"cveids":["CVE-2007-0856"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2007-02-07T19:36:54Z","publicdate":"2007-02-07T00:00:00Z","datefirstpublished":"2007-02-09T16:05:27Z","dateupdated":"2007-03-06T19:32:42Z","revision":17,"vrda_d1_directreport":"0","vrda_d1_population":"2","vrda_d1_impact":"3","cam_widelyknown":"15","cam_exploitation":"0","cam_internetinfrastructure":"5","cam_population":"10","cam_impact":"20","cam_easeofexploitation":"11","cam_attackeraccessrequired":"10","cam_scorecurrent":"8.25","cam_scorecurrentwidelyknown":"10.3125","cam_scorecurrentwidelyknownexploited":"18.5625","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":8.25,"vulnote":null}