Any PC-cillin users will want to look at this:
Trend Micro Products AntiVirus Library Buffer Overflow
Secunia Advisory: SA14396 Print Advisory Release Date: 2005-02-25
Critical: Highly critical Impact: System access Where: From remote Solution Status: Vendor Patch
Software: Trend Micro InterScan eManager 3.x Trend Micro InterScan Messaging Security Suite 5.x Trend Micro InterScan VirusWall 3.x Trend Micro InterScan Web Security Suite 1.x Trend Micro InterScan Web Security Suite 2.x Trend Micro InterScan WebManager 2.x Trend Micro InterScan WebProtect for ISA 3.x Trend Micro OfficeScan Corporate Edition 3.x Trend Micro OfficeScan Corporate Edition 5.x Trend Micro OfficeScan Corporate Edition 6.x Trend Micro PC-cillin 2000 Trend Micro PC-cillin 2002 Trend Micro PC-cillin 2003 Trend Micro PC-cillin Internet Security 2005 Trend Micro PortalProtect for SharePoint 1.x Trend Micro ScanMail eManager 3.x Trend Micro ScanMail eManager 5.x Trend Micro ScanMail for Lotus Notes 2.x Trend Micro ScanMail for Lotus Notes 3.x Trend Micro ScanMail for Microsoft Exchange 3.x Trend Micro ScanMail for Microsoft Exchange 6.x Trend Micro ServerProtect for Linux 1.x Trend Micro ServerProtect for Windows/NetWare 5.x
Select a product and view a complete list of all Patched/Unpatched Secunia advisories affecting it.
Description:
ISS X-Force has reported a vulnerability in various Trend Micro products, which can be exploited by malicious people to compromise a vulnerable system.
The vulnerability is caused due to a boundary error in the AntiVirus library when processing ARJ files. This can be exploited to cause a heap-based buffer overflow via a specially crafted ARJ file containing an overly long filename.
Successful exploitation allows execution of arbitrary code.
The vulnerability affects the following products: * Trend Micro Client / Server / Messaging Suite for SMB for Windows * Trend Micro Client / Server Suite for SMB for Windows * Trend Micro InterScan eManager * Trend Micro InterScan Messaging Security Suite for Linux * Trend Micro InterScan Messaging Security Suite for Solaris * Trend Micro InterScan Messaging Security Suite for Windows * Trend Micro InterScan VirusWall for AIX * Trend Micro InterScan VirusWall for HP-UX * Trend Micro InterScan VirusWall for Linux * Trend Micro InterScan VirusWall for SMB * Trend Micro InterScan VirusWall for Solaris * Trend Micro InterScan VirusWall for Windows * Trend Micro InterScan Web Security Suite for Linux * Trend Micro InterScan Web Security Suite for Solaris * Trend Micro InterScan Web Security Suite for Windows * Trend Micro InterScan WebManager * Trend Micro InterScan WebProtect for ISA * Trend Micro OfficeScan Corp. Edition * Trend Micro PC-cillin Internet Security * Trend Micro PortalProtect for SharePoint * Trend Micro ScanMail eManager * Trend Micro ScanMail for Lotus Domino on AIX * Trend Micro ScanMail for Lotus Domino on AS/400 * Trend Micro ScanMail for Lotus Domino on S/390 * Trend Micro ScanMail for Lotus Domino on Solaris * Trend Micro ScanMail for Lotus Domino on Windows * Trend Micro ScanMail for Microsoft Exchange * Trend Micro ServerProtect for Linux * Trend Micro ServerProtect for Windows
Solution: Update scan engine to VSAPI 7.510 or later. http://www.trendmicro.com/download/engine.asp
Provided and/or discovered by: Alex Wheeler, ISS X-Force.
Original Advisory: Trend Micro: http://www.trendmicro.com/vinfo/...ould+allow+Remote+Code+execution
ISS X-Force: http://xforce.iss.net/xforce/alerts/id/189
Please note: The information, which this Secunia Advisory is based upon, comes from third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
Peter Kaulback -- -- I haven't failed, I've found 10,000 ways that don't work.
Thomas Edison (1847-1931) ============= PCWorks Mailing List ================= Don't see your post? Check our posting guidelines & make sure you've followed proper posting procedures, http://pcworkers.com/rules.htm Contact list owner <[EMAIL PROTECTED]> Unsubscribing and other changes: http://pcworkers.com =====================================================
