CVE-2007-0856

published 2007-02-08

CVE-2007-0856: TmComm.sys 1.5.0.1052 in the Trend Micro Anti-Rootkit Common Module (RCM), with the VsapiNI.sys 3.320.0.1003 scan engine, as used in Trend Micro PC-cillin…

Priority P4 29 high 7.2 CVSS 2.0

AV L AC L Au N C C I C A C

TmComm.sys 1.5.0.1052 in the Trend Micro Anti-Rootkit Common Module (RCM), with the VsapiNI.sys 3.320.0.1003 scan engine, as used in Trend Micro PC-cillin Internet Security 2007, Antivirus 2007, Anti-Spyware for SMB 3.2 SP1, Anti-Spyware for Consumer 3.5, Anti-Spyware for Enterprise 3.0 SP2, Client / Server / Messaging Security for SMB 3.5, Damage Cleanup Services 3.2, and possibly other products, assigns Everyone write permission for the \\.\TmComm DOS device interface, which allows local users to access privileged IOCTLs and execute arbitrary code or overwrite arbitrary memory in the kernel context.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
trend_micro	client-server-messaging_security	—	—
trend_micro	damage_cleanup_services	—	—
trend_micro	pc-cillin_internet_security	—	—
trend_micro	tmcomm.sys	—	—
trend_micro	trend_micro_antispyware	—	—
trend_micro	trend_micro_antispyware	—	—
trend_micro	trend_micro_antispyware	—	—
trend_micro	trend_micro_antivirus	—	—
trend_micro	vsapini.sys	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.