CVE-2008-2433

Published: Aug 27, 2008Modified: Apr 23, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The web management console in Trend Micro OfficeScan 7.0 through 8.0, Worry-Free Business Security 5.0, and Client/Server/Messaging Suite 3.5 and 3.6 creates a random session token based only on the login time, which makes it easier for remote attackers to hijack sessions via brute-force attacks. NOTE: this can be leveraged for code execution through an unspecified "manipulation of the configuration."

Affected (4)

Products: Trendmicro: Client Server Messaging Suite, Officescan, Worry Free Business Security

3 products

Client Server Messaging Suite

Worry Free Business Security

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Trendmicro Client Server Messaging Suite	Version 3.5
Trendmicro Client Server Messaging Suite	Version 3.6
Trendmicro Officescan	From 7.0 to 8.0
Trendmicro Worry Free Business Security	Version 5.0

Related CWEs

Use of Insufficiently Random Values

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

References (20)

http://secunia.com/advisories/31373

Source: PSIRT-CNA@flexerasoftware.com

Broken LinkPatchVendor Advisory

http://secunia.com/secunia_research/2008-31/advisory/

Source: PSIRT-CNA@flexerasoftware.com

Broken LinkVendor Advisory

http://securityreason.com/securityalert/4191

Source: PSIRT-CNA@flexerasoftware.com

Broken Link

http://www.securityfocus.com/archive/1/495670/100/0/threaded

Source: PSIRT-CNA@flexerasoftware.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/30792

Source: PSIRT-CNA@flexerasoftware.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1020732

Source: PSIRT-CNA@flexerasoftware.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.trendmicro.com/ftp/documentation/readme/OSCE_8.0_SP1_Win_EN_CriticalPatch_B2402_readme.txt

Source: PSIRT-CNA@flexerasoftware.com

Vendor Advisory

http://www.trendmicro.com/ftp/documentation/readme/Readme_WFBS5%200_EN_CriticalPatch1404.txt

Source: PSIRT-CNA@flexerasoftware.com

Vendor Advisory

http://www.vupen.com/english/advisories/2008/2421

Source: PSIRT-CNA@flexerasoftware.com

Broken Link

https://exchange.xforce.ibmcloud.com/vulnerabilities/44597

Source: PSIRT-CNA@flexerasoftware.com

Third Party AdvisoryVDB Entry

http://secunia.com/advisories/31373

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkPatchVendor Advisory

http://secunia.com/secunia_research/2008-31/advisory/

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkVendor Advisory

http://securityreason.com/securityalert/4191

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://www.securityfocus.com/archive/1/495670/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkThird Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/30792

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1020732

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkThird Party AdvisoryVDB Entry

http://www.trendmicro.com/ftp/documentation/readme/OSCE_8.0_SP1_Win_EN_CriticalPatch_B2402_readme.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.trendmicro.com/ftp/documentation/readme/Readme_WFBS5%200_EN_CriticalPatch1404.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.vupen.com/english/advisories/2008/2421

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

https://exchange.xforce.ibmcloud.com/vulnerabilities/44597

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

Timeline

No history available yet.