CVE-2008-3866

MediumCVSS 4.6/10Last modified Jun 16, 2026

Description

The Trend Micro Personal Firewall service (aka TmPfw.exe) in Trend Micro Network Security Component (NSC) modules, as used in Trend Micro OfficeScan 8.0 SP1 Patch 1 and Internet Security 2007 and 2008 17.0.1224, relies on client-side password protection implemented in the configuration GUI, which allows local users to bypass intended access restrictions and change firewall settings by using a modified client to send crafted packets.

Metrics

CVSS 2.0 4.6/10AV:L/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/31160Patch, Vendor Advisory
http://secunia.com/advisories/33609Patch, Vendor Advisory
http://secunia.com/secunia_research/2008-43/Vendor Advisory
http://www.securityfocus.com/bid/33358Patch
http://www.securitytracker.com/id?1021616
http://www.securitytracker.com/id?1021617
http://www.trendmicro.com/ftp/documentation/readme/OSCE8.0_SP1_Patch1_CriticalPatch_3191_Readme.txtVendor Advisory
http://www.vupen.com/english/advisories/2009/0191
https://exchange.xforce.ibmcloud.com/vulnerabilities/48108
http://secunia.com/advisories/31160Patch, Vendor Advisory
http://secunia.com/advisories/33609Patch, Vendor Advisory
http://secunia.com/secunia_research/2008-43/Vendor Advisory
http://www.securityfocus.com/bid/33358Patch
http://www.securitytracker.com/id?1021616
http://www.securitytracker.com/id?1021617
http://www.trendmicro.com/ftp/documentation/readme/OSCE8.0_SP1_Patch1_CriticalPatch_3191_Readme.txtVendor Advisory
http://www.vupen.com/english/advisories/2009/0191
https://exchange.xforce.ibmcloud.com/vulnerabilities/48108

Timeline

Published: Jan 21, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-38676.8SQL injection vulnerability in spaces/emailuser.php in Interact 2.4.1 allows remote attackers to execute arbitrary SQL commands via the emai CVE-2008-38686.8Cross-site request forgery (CSRF) vulnerability in Interact 2.4.1 allows remote attackers to hijack the authentication of super administrato CVE-2008-386910.0Heap-based buffer overflow in sadmind in Sun Solaris 8 and 9 allows remote attackers to execute arbitrary code via a crafted RPC request, re CVE-2008-387010.0Integer overflow in sadmind in Sun Solaris 8 and 9 allows remote attackers to execute arbitrary code via a crafted RPC request that triggers CVE-2008-38719.3Multiple format string vulnerabilities in UltraISO 9.3.1.2633, and possibly other versions before 9.3.3.2685, allow user-assisted attackers CVE-2008-38729.3Adobe Flash Player 8.0.39.0 and earlier, and 9.x up to 9.0.115.0, allows remote attackers to bypass the allowScriptAccess parameter setting CVE-2008-38734.3The System.setClipboard method in ActionScript in Adobe Flash Player 9.0.124.0 and earlier allows remote attackers to populate the clipboard CVE-2008-38743.5Cross-site scripting (XSS) vulnerability in account.php in Lussumo Vanilla 1.1.5-rc1, 1.1.4, and earlier allows remote authenticated users t CVE-2008-38757.2The kernel in Sun Solaris 8 through 10 and OpenSolaris before snv_90 allows local users to bypass chroot, zones, and the Solaris Trusted Ext CVE-2008-38761.9Apple iPhone 2.0.2, in some configurations, allows physically proximate attackers to bypass intended access restrictions, and obtain sensiti CVE-2008-38779.3Stack-based buffer overflow in Acoustica Mixcraft 4.1 Build 96 and 4.2 Build 98 allows user-assisted attackers to execute arbitrary code via CVE-2008-38789.3Stack-based buffer overflow in the Ultra.OfficeControl ActiveX control in OfficeCtrl.ocx 2.0.2008.801 in Ultra Shareware Ultra Office Contro