CVE-2009-0686 - Vulnerability Details - OpenCVE

The TrendMicro Activity Monitor Module (tmactmon.sys) 2.52.0.1002 in Trend Micro Internet Pro 2008 and 2009, and Security Pro 2008 and 2009, allows local users to gain privileges via a crafted IRP in a METHOD_NEITHER IOCTL request to \Device\tmactmon that overwrites memory.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

The EPSS score is 0.00126.

Key SSVC decision points have not yet been added.

Vendors	Products
Trendmicro Subscribe	Internet Security Subscribe

Configuration 1 [-]

OR	cpe:2.3:a:trendmicro:internet_security:2008:::::::*
	cpe:2.3:a:trendmicro:internet_security:2008:-:pro:::::*
	cpe:2.3:a:trendmicro:internet_security:2009:::::::*
	cpe:2.3:a:trendmicro:internet_security:2009:-:pro:::::*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2009-0686	The TrendMicro Activity Monitor Module (tmactmon.sys) 2.52.0.1002 in Trend Micro Internet Pro 2008 and 2009, and Security Pro 2008 and 2009, allows local users to gain privileges via a crafted IRP in a METHOD_NEITHER IOCTL request to \Device\tmactmon that overwrites memory.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://en.securitylab.ru/lab/PT-2009-09
http://milw0rm.com/sploits/2009-trendmicro_local_expl_0day.zip
http://www.securityfocus.com/archive/1/502314/100/0/threaded
http://www.securityfocus.com/bid/34304
http://www.securitytracker.com/id?1021955
https://exchange.xforce.ibmcloud.com/vulnerabilities/49513
https://www.exploit-db.com/exploits/8322

History

No history.

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2009-04-01T10:00:00

Updated: 2024-08-07T04:40:05.184Z

Reserved: 2009-02-22T00:00:00

Link: CVE-2009-0686

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2009-04-01T10:30:00.250

Modified: 2025-04-09T00:30:58.490

Link: CVE-2009-0686

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-399

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2009-03-31T00:00:00", "descriptions": [{"lang": "en", "value": "The TrendMicro Activity Monitor Module (tmactmon.sys) 2.52.0.1002 in Trend Micro Internet Pro 2008 and 2009, and Security Pro 2008 and 2009, allows local users to gain privileges via a crafted IRP in a METHOD_NEITHER IOCTL request to \\Device\\tmactmon that overwrites memory."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-10T18:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "8322", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "https://www.exploit-db.com/exploits/8322"}, {"name": "1021955", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1021955"}, {"name": "34304", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/34304"}, {"tags": ["x_refsource_MISC"], "url": "http://milw0rm.com/sploits/2009-trendmicro_local_expl_0day.zip"}, {"tags": ["x_refsource_MISC"], "url": "http://en.securitylab.ru/lab/PT-2009-09"}, {"name": "trend-tmactmon-privilege-escalation(49513)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49513"}, {"name": "20090331 [Positive Technologies SA 2009-09] Trend Micro Internet Security Pro 2009 tmactmon.sys Priviliege Escalation Vulnerabilities", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/502314/100/0/threaded"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2009-0686", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The TrendMicro Activity Monitor Module (tmactmon.sys) 2.52.0.1002 in Trend Micro Internet Pro 2008 and 2009, and Security Pro 2008 and 2009, allows local users to gain privileges via a crafted IRP in a METHOD_NEITHER IOCTL request to \\Device\\tmactmon that overwrites memory."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "8322", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/8322"}, {"name": "1021955", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1021955"}, {"name": "34304", "refsource": "BID", "url": "http://www.securityfocus.com/bid/34304"}, {"name": "http://milw0rm.com/sploits/2009-trendmicro_local_expl_0day.zip", "refsource": "MISC", "url": "http://milw0rm.com/sploits/2009-trendmicro_local_expl_0day.zip"}, {"name": "http://en.securitylab.ru/lab/PT-2009-09", "refsource": "MISC", "url": "http://en.securitylab.ru/lab/PT-2009-09"}, {"name": "trend-tmactmon-privilege-escalation(49513)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49513"}, {"name": "20090331 [Positive Technologies SA 2009-09] Trend Micro Internet Security Pro 2009 tmactmon.sys Priviliege Escalation Vulnerabilities", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/502314/100/0/threaded"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T04:40:05.184Z"}, "title": "CVE Program Container", "references": [{"name": "8322", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "https://www.exploit-db.com/exploits/8322"}, {"name": "1021955", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id?1021955"}, {"name": "34304", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/34304"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://milw0rm.com/sploits/2009-trendmicro_local_expl_0day.zip"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://en.securitylab.ru/lab/PT-2009-09"}, {"name": "trend-tmactmon-privilege-escalation(49513)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49513"}, {"name": "20090331 [Positive Technologies SA 2009-09] Trend Micro Internet Security Pro 2009 tmactmon.sys Priviliege Escalation Vulnerabilities", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/502314/100/0/threaded"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2009-0686", "datePublished": "2009-04-01T10:00:00", "dateReserved": "2009-02-22T00:00:00", "dateUpdated": "2024-08-07T04:40:05.184Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:trendmicro:internet_security:2008:*:*:*:*:*:*:*", "matchCriteriaId": "871D717F-5282-4445-B786-57910FED8FDF", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:internet_security:2008:-:pro:*:*:*:*:*", "matchCriteriaId": "ADC2E9E8-154C-48AF-A2C4-73FA11D56E02", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:internet_security:2009:*:*:*:*:*:*:*", "matchCriteriaId": "77C56412-5316-49A1-A2F1-1A8DEFBF3FB9", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:internet_security:2009:-:pro:*:*:*:*:*", "matchCriteriaId": "7C7304ED-62AF-4E7D-B68C-261F6795F97A", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The TrendMicro Activity Monitor Module (tmactmon.sys) 2.52.0.1002 in Trend Micro Internet Pro 2008 and 2009, and Security Pro 2008 and 2009, allows local users to gain privileges via a crafted IRP in a METHOD_NEITHER IOCTL request to \\Device\\tmactmon that overwrites memory."}, {"lang": "es", "value": "Activity Monitor Module de TrendMicro (tmactmon.sys) versi\u00f3n 2.52.0.1002 en Internet Pro 2008 y 2009, y Security Pro 2008 y 2009 de Trend Micro, permite a los usuarios locales alcanzar privilegios por medio de un IRP dise\u00f1ado en una petici\u00f3n IOCTL METHOD_NEITHER a \\Device\\tmactmon que sobrescribe la memoria."}], "id": "CVE-2009-0686", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2009-04-01T10:30:00.250", "references": [{"source": "cve@mitre.org", "url": "http://en.securitylab.ru/lab/PT-2009-09"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://milw0rm.com/sploits/2009-trendmicro_local_expl_0day.zip"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/502314/100/0/threaded"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/34304"}, {"source": "cve@mitre.org", "url": "http://www.securitytracker.com/id?1021955"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49513"}, {"source": "cve@mitre.org", "url": "https://www.exploit-db.com/exploits/8322"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://en.securitylab.ru/lab/PT-2009-09"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://milw0rm.com/sploits/2009-trendmicro_local_expl_0day.zip"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/502314/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/34304"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id?1021955"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49513"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.exploit-db.com/exploits/8322"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-399"}], "source": "nvd@nist.gov", "type": "Primary"}]}