[1][USEMAP:frame_r1_c1.gif] [frame_r1_c3.gif] [2]Japanese SNS Advisory [title2_r1_c1.gif] [3][GoIndex.gif] [4][GoBack.gif] 29 [5][GoNext.gif] [6]Japanese Edition SNS Advisory No.29 Trend Micro Virus Control System(VCS) Unauthenticated CGI Usage Vulnerability Problem first discovered: 25 May 2001 Published: 7 Jun 2001 Last Updated: 7 Jun 2001 _________________________________________________________________ Overview: A vulnerability was found in a CGI program included withTrendMicro Virus Control System(VCS). It may be possible for a remote user to access administrative program and data without authentication. Problem Description: VCS is a software package designed to operate and manage anti virus product included in gateways, file servers, groupwares and clients. In order to manage VCS, an administrator accesses with the following URL. http://VCSServer/tvcs/EnterPassword.html Password for its administrator is normally required. By calling a certain CGI program in an unusual way, it is possible to change the configuration and view configuration files. The details cannot be provided now because it has not been fixed and it will not be fixed immediately. Tested Version: Virus Control System(VCS) Ver.1.8 Japanese Virus Control System(VCS) Ver.1.8 English Tested OS: Windows 2000 Server [English Version] Windows 2000 Server [Japanese Version] Patch Information: No patches are available now. Trend Micro support team responded that this problem will be fixed at end of this year. Until the patch is released, it is recommended that you set up access control to refuse access to servers in which VCS is installed by non-administrative user. Discovered by: Nobuo Miwa (LAC / [7]n-miwa@lac.co.jp) Disclaimer: All information in these advisories are subject to change without any advanced notices neither mutual consensus, and each of them is released as it is. LAC Co.,Ltd. is not responsible for any risks of occurrences caused by applying those information. _________________________________________________________________ Copyright(c) 1995-2002 Little eArth Corporation References 1. LYNXIMGMAP:http://www.lac.co.jp/security/english/snsadv_e/29_e.html#r1_c1Map 2. http://www.lac.co.jp/security/index.html 3. http://www.lac.co.jp/security/english/snsadv_e/index.html 4. http://www.lac.co.jp/security/english/snsadv_e/28_e.html 5. http://www.lac.co.jp/security/english/snsadv_e/30_e.html 6. http://www.lac.co.jp/security/intelligence/SNSAdvisory/29.html 7. mailto:n-miwa@lac.co.jp