Details of VAR-202103-1322

ID

VAR-202103-1322

CVE

CVE-2021-25252

TITLE

plural Trend Micro Resource depletion vulnerability in the product

Trust: 0.8

sources: JVNDB: JVNDB-2021-004941

DESCRIPTION

Trend Micro's Virus Scan API (VSAPI) and Advanced Threat Scan Engine (ATSE) - are vulnerable to a memory exhaustion vulnerability that may lead to denial-of-service or system freeze if exploited by an attacker using a specially crafted file. plural Trend Micro The product contains a resource depletion vulnerability.Denial of service (DoS) It may be put into a state

Trust: 1.62

sources: NVD: CVE-2021-25252 // JVNDB: JVNDB-2021-004941

AFFECTED PRODUCTS

vendor:	trendmicro	model:	deep security	scope:	eq	version:	12.0	Trust: 1.0
vendor:	trendmicro	model:	interscan web security virtual appliance	scope:	eq	version:	6.5	Trust: 1.0
vendor:	trendmicro	model:	serverprotect for network appliance filers	scope:	eq	version:	5.8	Trust: 1.0
vendor:	trendmicro	model:	deep security	scope:	eq	version:	20.0	Trust: 1.0
vendor:	trendmicro	model:	apex one	scope:	eq	version:	2019	Trust: 1.0
vendor:	trendmicro	model:	scanmail	scope:	eq	version:	14.0	Trust: 1.0
vendor:	trendmicro	model:	serverprotect for storage	scope:	eq	version:	6.0	Trust: 1.0
vendor:	trendmicro	model:	scanmail for ibm domino	scope:	eq	version:	5.8	Trust: 1.0
vendor:	trendmicro	model:	apex one	scope:	eq	version:	-	Trust: 1.0
vendor:	trendmicro	model:	interscan messaging security virtual appliance	scope:	eq	version:	9.1	Trust: 1.0
vendor:	trendmicro	model:	deep discovery inspector	scope:	eq	version:	3.8	Trust: 1.0
vendor:	trendmicro	model:	cloud edge	scope:	eq	version:	5.0	Trust: 1.0
vendor:	trendmicro	model:	safe lock	scope:	eq	version:	1.1	Trust: 1.0
vendor:	trendmicro	model:	officescan	scope:	eq	version:	-	Trust: 1.0
vendor:	trendmicro	model:	worry-free business security	scope:	eq	version:	10.1	Trust: 1.0
vendor:	trendmicro	model:	deep security	scope:	eq	version:	10.0	Trust: 1.0
vendor:	trendmicro	model:	deep discovery analyzer	scope:	eq	version:	5.1	Trust: 1.0
vendor:	trendmicro	model:	control manager	scope:	eq	version:	7.0	Trust: 1.0
vendor:	trendmicro	model:	apex central	scope:	eq	version:	2019	Trust: 1.0
vendor:	trendmicro	model:	deep security	scope:	eq	version:	11.0	Trust: 1.0
vendor:	trendmicro	model:	portal protect	scope:	eq	version:	2.6	Trust: 1.0
vendor:	trendmicro	model:	deep discovery email inspector	scope:	eq	version:	2.5	Trust: 1.0
vendor:	trendmicro	model:	serverprotect	scope:	eq	version:	5.8	Trust: 1.0
vendor:	トレンドマイクロ	model:	apex one	scope:	-	version:	-	Trust: 0.8
vendor:	トレンドマイクロ	model:	trend micro control manager	scope:	-	version:	-	Trust: 0.8
vendor:	トレンドマイクロ	model:	deep discovery inspector	scope:	-	version:	-	Trust: 0.8
vendor:	トレンドマイクロ	model:	interscan messaging security virtual appliance	scope:	-	version:	-	Trust: 0.8
vendor:	トレンドマイクロ	model:	cloud edge	scope:	-	version:	-	Trust: 0.8
vendor:	トレンドマイクロ	model:	trend micro deep security	scope:	-	version:	-	Trust: 0.8
vendor:	トレンドマイクロ	model:	deep discovery analyzer	scope:	-	version:	-	Trust: 0.8
vendor:	トレンドマイクロ	model:	deep discovery email inspector	scope:	-	version:	-	Trust: 0.8
vendor:	トレンドマイクロ	model:	trendmicro interscan web security virtual appliance	scope:	-	version:	-	Trust: 0.8
vendor:	トレンドマイクロ	model:	apex central	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2021-004941 // NVD: CVE-2021-25252

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2021-25252
value:	MEDIUM
Trust: 1.8
CNNVD:	CNNVD-202103-242
value:	MEDIUM
Trust: 0.6

NVD:	CVE-2021-25252
severity:	MEDIUM
baseScore:	4.9
vectorString:	AV:L/AC:L/AU:N/C:N/I:N/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8

NVD:	CVE-2021-25252
baseSeverity:	MEDIUM
baseScore:	5.5
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2021-25252
baseSeverity:	MEDIUM
baseScore:	5.5
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2021-004941 // CNNVD: CNNVD-202103-242 // NVD: CVE-2021-25252

PROBLEMTYPE DATA

problemtype:	CWE-400	Trust: 1.0
problemtype:	Resource exhaustion (CWE-400) [NVD Evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2021-004941 // NVD: CVE-2021-25252

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202103-242

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-202103-242

CONFIGURATIONS

sources: NVD: CVE-2021-25252

PATCH

title:

000285675

url:

https://success.trendmicro.com/solution/000285675

Trust: 0.8

sources: JVNDB: JVNDB-2021-004941

EXTERNAL IDS

db:	NVD	id:	CVE-2021-25252	Trust: 2.4
db:	JVN	id:	JVNVU93009588	Trust: 0.8
db:	JVNDB	id:	JVNDB-2021-004941	Trust: 0.8
db:	CNNVD	id:	CNNVD-202103-242	Trust: 0.6

sources: JVNDB: JVNDB-2021-004941 // CNNVD: CNNVD-202103-242 // NVD: CVE-2021-25252

REFERENCES

url:	https://success.trendmicro.com/solution/000285675	Trust: 1.6
url:	http://jvn.jp/vu/jvnvu93009588/index.html	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2021-25252	Trust: 0.8
url:	https://vigilance.fr/vulnerability/trend-micro-scan-engine-denial-of-service-via-memory-exhaustion-34744	Trust: 0.6

sources: JVNDB: JVNDB-2021-004941 // CNNVD: CNNVD-202103-242 // NVD: CVE-2021-25252

SOURCES

db:	JVNDB	id:	JVNDB-2021-004941
db:	CNNVD	id:	CNNVD-202103-242
db:	NVD	id:	CVE-2021-25252

LAST UPDATE DATE

2022-05-04T08:33:12.367000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2021-004941	date:	2021-12-02T09:04:00
db:	CNNVD	id:	CNNVD-202103-242	date:	2021-03-25T00:00:00
db:	NVD	id:	CVE-2021-25252	date:	2021-09-08T17:23:00

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2021-004941	date:	2021-12-02T00:00:00
db:	CNNVD	id:	CNNVD-202103-242	date:	2021-03-03T00:00:00
db:	NVD	id:	CVE-2021-25252	date:	2021-03-03T16:15:00