Buffer overflow in Trend Micro Antivirus Plus Antispyware
CVE-2007-6386
Stack-based buffer overflow in PccScan.dll before build 1451 in Trend Micro AntiVirus plus AntiSpyware 2008, Internet Security 2008, and Internet Security Pro 2008 allows user-assisted remote attackers to cause a denial of service (SfCtlCom.exe crash), and allows local users to gain privileges, via a malformed .zip archive with a long name, as demonstrated by a .zip file created via format string specifiers in a crafted .uue file.
Vulnerability class: Buffer Overflow
EPSS: 0.010 (60.2th percentile) — read the EPSS interpretation.
Affected products
- Trend_micro Trend_micro_antivirus_plus_antispyware — versions 2008
- Trend_micro Trend_micro_internet_security_pro
- Trend_micro Trend_micro_internet_security__virus_bust — versions 2008
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Patch, x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (vdb-entry, x_refsource_VUPEN)
- cve@mitre.org (x_refsource_CONFIRM, Patch)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (x_refsource_OSVDB, vdb-entry)
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (x_refsource_OSVDB, vdb-entry)