CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 6.6
CWE Name:  Permissions Privileges and Access Controls
Summary: the trend micro antivirus scan engine before 8.550-1001, as used in trend micro pc-cillin internet security 2007, and tmxpflt.sys 8.320.1004 and 8.500.0.1002, has weak permissions (everyone:write) for the \\.\tmfilter device, which allows local users to send arbitrary content to the device via the ioctl functionality.  note: this can be leveraged for privilege escalation by exploiting a buffer overflow in the handler for ioctl 0xa0284403.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: LOCAL
Impact (C/I/A): NONE/COMPLETE/COMPLETE
Published Date: 2007-10-30
Last Modified Date: 2011-03-08