ZDI-CAN-10794: Trend Micro OfficeScan Hard Link Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro OfficeScan. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the OfficeScan Security Agent. By creating a hard link, an attacker can abuse the service to overwrite the contents of a chosen file. An attacker can leverage this vulnerability to escalate privileges and execute code as an administrator.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-10794?
The severity of ZDI-CAN-10794 is significant due to the potential for local privilege escalation on affected systems.
How do I fix ZDI-CAN-10794?
To fix ZDI-CAN-10794, apply the latest security updates or patches provided by Trend Micro for OfficeScan.
Who is affected by ZDI-CAN-10794?
ZDI-CAN-10794 affects installations of Trend Micro OfficeScan XG that have not been updated to address this vulnerability.
What type of attack is ZDI-CAN-10794 associated with?
ZDI-CAN-10794 is associated with local privilege escalation attacks that require pre-existing low-privileged code execution.
Can remote attackers exploit ZDI-CAN-10794?
No, ZDI-CAN-10794 can only be exploited by local attackers who have access to execute code on the target system.