CVE-2007-4218 — Improper Input Validation in Micro Serverprotect

CWE-20 — Improper Input ValidationCWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-1893 documents3 sources
Severity
10.0CRITICALNVD
EPSS
59.3%
top 1.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Trend Micro Serverprotect
Timeline
PublishedAug 22
Latest updateMay 1

Description

Multiple buffer overflows in the ServerProtect service (SpntSvc.exe) in Trend Micro ServerProtect for Windows before 5.58 Security Patch 4 allow remote attackers to execute arbitrary code via certain RPC requests to certain TCP ports that are processed by the (1) RPCFN_ENG_NewManualScan, (2) RPCFN_ENG_TimedNewManualScan, and (3) RPCFN_SetComputerName functions in (a) StRpcSrv.dll; the (4) RPCFN_CMON_SetSvcImpersonateUser and (5) RPCFN_OldCMON_SetSvcImpersonateUser functions in (b) Stcommon.dll; …

CVSS vector

AV:N/AC:L/C:C/I:C/A:CExploitability: 10.0 | Impact: 10.0

Affected Packages1 packages

Patches

Patch: secunia.com ↗Patch: www.securityfocus.com ↗Patch: secunia.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-gp64-xw5c-22fh: Multiple buffer overflows in the ServerProtect service (SpntSvc↗2022-05-01
▶
CVEList
CVE-2007-4218: Multiple buffer overflows in the ServerProtect service (SpntSvc↗2007-08-22
▶
CVE-2007-4218 — Improper Input Validation in Trend | cvebase