Unscored severity · published Feb 8, 2007
CVE-2007-0856
TmComm.sys 1.5.0.1052 in the Trend Micro Anti-Rootkit Common Module (RCM), with the VsapiNI.sys 3.320.0.1003 scan engine, as used in Trend Micro PC-cillin Internet Security 2007,…
–
CVSS
1%
EPSS
No
On KEV
Description
TmComm.sys 1.5.0.1052 in the Trend Micro Anti-Rootkit Common Module (RCM), with the VsapiNI.sys 3.320.0.1003 scan engine, as used in Trend Micro PC-cillin Internet Security 2007, Antivirus 2007, Anti-Spyware for SMB 3.2 SP1, Anti-Spyware for Consumer 3.5, Anti-Spyware for Enterprise 3.0 SP2, Client / Server / Messaging Security for SMB 3.5, Damage Cleanup Services 3.2, and possibly other products, assigns Everyone write permission for the \\.\TmComm DOS device interface, which allows local users to access privileged IOCTLs and execute arbitrary code or overwrite arbitrary memory in the kernel context.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Client-server-messaging Security · Trend Micro
3.5 · source: NVD
DC
Damage Cleanup Services · Trend Micro
3.2 · source: NVD
PI
Pc-cillin Internet Security · Trend Micro
2007 · source: NVD
TM
Tmcomm.sys · Trend Micro
1.5.1052 · source: NVD
TM
Trend Micro Antirootkit Common Module · Trend Micro
All versions, or not specified · source: NVD
TM
Trend Micro Antispyware · Trend Micro
3.0_sp2; 3.2_sp1; 3.5 · source: NVD
TM
Trend Micro Antivirus · Trend Micro
2007 · source: NVD
VS
Vsapini.sys · Trend Micro
3.320.1003 · source: NVD
Affected product
CS
Client-server-messaging Security
Trend Micro
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-0856
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-0856
Patch
http://esupport.trendmicro.com/support/viewxml.do?ContentID=EN-1034432&id=EN-1034432
Vendor Advisory
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=469
osvdb.org
http://osvdb.org/33039
Patch
http://secunia.com/advisories/24069
securitytracker.com
http://securitytracker.com/id?1017604
securitytracker.com
http://securitytracker.com/id?1017605
More from Client-server-messaging Security
–
CVE-2008-2437
Stack-based buffer overflow in cgiRecvFile.exe in Trend Micro OfficeScan 7.3 patch 4 build 1362 and other builds, OfficeScan 8.0 and 8.0 SP1, and Client Server Messaging Security…
–
CVE-2007-0325
Multiple buffer overflows in the Trend Micro OfficeScan Web-Deployment SetupINICtrl ActiveX control in OfficeScanSetupINI.dll, as used in OfficeScan 7.0 before Build 1344,…