Mageni Mageni Security LLC

Free and open-source vulnerability scanner

Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.

Install Now

Available for macOS, Windows, and Linux

App screenshot

CVE-2006-0642

CVE information

Published

17 years ago

Last Modified

4 years ago

CVSSv2.0 Severity

Medium

Impact Analysis

Share

Description

Trend Micro ServerProtect 5.58, and possibly InterScan Messaging Security Suite and InterScan Web Security Suite, have a default configuration setting of "Do not scan compressed files when Extracted file count exceeds 500 files," which may be too low in certain circumstances, which allows remote attackers to bypass anti-virus checks by sending compressed archives containing many small files. NOTE: since this is related to a configuration setting that has an operational impact that might vary depending on the environment, and the product is claimed to report a message when the compressed file exceeds specified limits, perhaps this should not be included in CVE..

CVSSv2.0 Score

Severity
Medium
Base Score
5.1/10
Exploit Score
4.9/10
Access Vector
Network
Access Complexity
High
Authentication Required
None
Impact Score
6.4/10
Confidentiality Impact
Partial
Availability Impact
Partial
Integrity Impact
Partial

Products Affected

CPE Affected Vulnerable Excluding Edit
cpe:2.3:a:trend_micro:interscan_web_security_suite:*:*:*:*:*
  Yes
- -
cpe:2.3:a:trend_micro:interscan_messaging_security_suite:*:*
  Yes
- -
cpe:2.3:a:trend_micro:serverprotect:5.58:*:emc:*:*:*:*:*
  Yes
- -

References