CVE-2008-2433 Weak cryptography in n/a
Weak session token generation allows remote attackers to hijack sessions and potentially execute code via configuration manipulation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2008-2433?
CVE-2008-2433 is a critical vulnerability in Trendmicro Officescan, published on 27 Aug 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The web management console in Trend Micro OfficeScan 7.0 through 8.0, Worry-Free Business Security 5.0, and Client/Server/Messaging Suite 3.5 and 3.6 creates a random session token based only on the login time, which makes it easier for remote attackers to hijack sessions via brute-force attacks. NOTE: this can be leveraged for code execution through an unspecified "manipulation of the configuration."
Weakness: CWE-330
Which versions are affected by CVE-2008-2433?
It affects 3 products.
Products include Trendmicro Client Server Messaging Suite, Trendmicro Officescan, Trendmicro Worry-Free Business Security.
How do I fix CVE-2008-2433?
No fix has been published for CVE-2008-2433 yet. Limit exposure of the affected software until one is available.
Is CVE-2008-2433 being exploited?
There is no known exploitation of CVE-2008-2433 in the wild and no public exploit code.
Sources
Also known as GHSA-4rj2-hhfh-p3j7.