CVE-2001-1151: Medium severity Trend Micro OfficeScan vulnerability

Published Oct 15, 2001

Updated

Trend Micro OfficeScan Corporate Edition (aka Virus Buster) 3.53 allows remote attackers to access sensitive information from the hotdownload directory without authentication, such as the ofcscan.ini configuration file, which contains a weakly encrypted password.

Affected Software

2 affected components

Trend Micro OfficeScan=corporate_3.53

Trend Micro Virus Buster=corporate_3.53

Remediation

Patch Available

http://www.securityfocus.com/archive/1/220666

Event History

Oct 15, 2001

CVE Published

04:00 AM

Mar 15, 2002

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2001-1151?

CVE-2001-1151 is considered to have a high severity level due to the potential access to sensitive configuration files without authentication.

How do I fix CVE-2001-1151?

To fix CVE-2001-1151, it is recommended to upgrade to a version of Trend Micro OfficeScan or Virus Buster that addresses this vulnerability.

What information can be accessed through CVE-2001-1151?

CVE-2001-1151 allows attackers to access sensitive files including the ofcscan.ini configuration file, which may contain weakly encrypted passwords.

Who is affected by CVE-2001-1151?

CVE-2001-1151 affects users of Trend Micro OfficeScan Corporate Edition and Virus Buster versions 3.53.

Is there a workaround for CVE-2001-1151?

Implementing tight access controls on the hotdownload directory can serve as a temporary workaround for CVE-2001-1151.