Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2008-1365 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Micro Officescan Corporate Edition

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer5 documents4 sources
Severity
6.4MEDIUMNVD
EPSS
75.2%
top 1.12%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Trend Micro Officescan Corporate Edition
Timeline
PublishedMar 17
Latest updateMay 1

Description

Stack-based buffer overflow in Trend Micro OfficeScan Corporate Edition 8.0 Patch 2 build 1189 and earlier, and 7.3 Patch 3 build 1314 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a long encrypted password, which triggers the overflow in (1) cgiChkMasterPwd.exe, (2) policyserver.exe as reachable through cgiABLogon.exe, and other vectors.

CVSS vector

AV:N/AC:L/C:N/I:P/A:PExploitability: 10.0 | Impact: 4.9

Affected Packages1 packages

▶NVDtrend_micro/officescan_corporate_edition7.3_patch3_build1314+1

🔴Vulnerability Details

2
GHSA
GHSA-qjvp-c4rx-5mjr: Stack-based buffer overflow in Trend Micro OfficeScan Corporate Edition 8↗2022-05-01
▶
CVEList
CVE-2008-1365: Stack-based buffer overflow in Trend Micro OfficeScan Corporate Edition 8↗2008-03-17
▶

💥Exploits & PoCs

2
Exploit-DB
Trend Micro OfficeScan - Remote Stack Buffer Overflow (Metasploit)↗2010-05-09
▶
Exploit-DB
Trend Micro OfficeScan - Buffer Overflow (Denial of Service) (PoC)↗2008-02-27
▶
CVE-2008-1365 — Trend vulnerability | cvebase