Trend Micro session token insufficiently random

Secunia, the security services provider, has issued a security advisory about a vulnerability in Trend Micro's OfficeScan 8.0 and Worry-Free Business Security 5.0 that makes it easier for attackers to take control of the web management of those products. According to Secunia, the web-based configuration interface uses a pseudo-random token to identify a logged-on manager, but its entropy is evidently based on the time at which the user logs in.

Knowing that, brute-force attackers could predict a valid password authentication token substantially more quickly and then use it to log in to the web interface. The report says that, besides changing settings, attackers could also execute their own arbitrary code.

Client Server Messaging Security for SMB 3.x and OfficeScan Corporate Edition 7.x are also affected. So far, Trend Micro has only provided updates for OfficeScan 8.0 and Worry-Free Business Security 5.0.

See also:

• Trend Micro Products Web Management Authentication Bypass, advisory from Secunia
• Trend Micro OfficeScan 8.0 Service Pack 1 Critical Patch - Build 2402, critical patch release from Trend Micro
• Worry-Free Business Security 5.0 - Security Server Critical Patch - Build 1404, critical patch release from Trend Micro

(djwm)