CVE-2008-2433: Critical severity trend micro client server messaging suite vulnerability
The web management console in Trend Micro OfficeScan 7.0 through 8.0, Worry-Free Business Security 5.0, and Client/Server/Messaging Suite 3.5 and 3.6 creates a random session token based only on the login time, which makes it easier for remote attackers to hijack sessions via brute-force attacks. NOTE: this can be leveraged for code execution through an unspecified "manipulation of the configuration."
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-2433?
CVE-2008-2433 is classified as a high-severity vulnerability that can allow remote session hijacking.
How do I fix CVE-2008-2433?
To fix CVE-2008-2433, update to the latest version of the affected Trend Micro products that address this vulnerability.
Which versions of Trend Micro are affected by CVE-2008-2433?
CVE-2008-2433 affects Trend Micro OfficeScan versions 7.0 to 8.0, Worry-Free Business Security 5.0, and Client/Server/Messaging Suite versions 3.5 and 3.6.
What type of attack does CVE-2008-2433 enable?
CVE-2008-2433 enables remote attackers to perform brute-force attacks and hijack user sessions.
Is CVE-2008-2433 difficult to exploit?
CVE-2008-2433 can be exploited with relative ease due to the predictable nature of the session token generation.