Trend Micro VSAPI ARJ Handling Heap Overflow Vulnerability
BID:12643
Info
Trend Micro VSAPI ARJ Handling Heap Overflow Vulnerability
| Bugtraq ID: | 12643 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2005-0533 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 24 2005 12:00AM |
| Updated: | Jul 12 2009 10:56AM |
| Credit: | Discovery is credited to Alex Wheeler. |
| Vulnerable: |
Trend Micro ServerProtect for Windows Trend Micro ServerProtect for Novell Netware Trend Micro ServerProtect for Linux 1.2 Trend Micro ServerProtect 5.3.1 Trend Micro ScanMail for Microsoft Exchange 6.1 Trend Micro ScanMail for Microsoft Exchange 3.81 Trend Micro ScanMail for Microsoft Exchange 3.8 Trend Micro ScanMail for Lotus Domino on Windows Trend Micro ScanMail for Lotus Domino on Solaris Trend Micro ScanMail for Lotus Domino on S/390 Trend Micro ScanMail for Lotus Domino on AS/400 Trend Micro ScanMail for Lotus Domino on AIX Trend Micro ScanMail for Domino 2.51 Trend Micro ScanMail for Domino 2.6 Trend Micro ScanMail eManager Trend Micro PortalProtect 1.0 Trend Micro PC-cillin 6.0 Trend Micro PC-cillin 2003 Trend Micro PC-cillin 2002 Trend Micro PC-cillin 2000 Trend Micro OfficeScan Corporate Edition for Windows NT Server 3.13 Trend Micro OfficeScan Corporate Edition for Windows NT Server 3.11 Trend Micro OfficeScan Corporate Edition for Windows NT Server 3.5 Trend Micro OfficeScan Corporate Edition for Windows NT Server 3.1.1 Trend Micro OfficeScan Corporate Edition for Windows NT Server 3.0 Trend Micro OfficeScan Corporate Edition 6.5 Trend Micro OfficeScan Corporate Edition 5.58 Trend Micro OfficeScan Corporate Edition 5.5 Trend Micro OfficeScan Corporate Edition 5.0 2 Trend Micro OfficeScan Corporate Edition 3.54 Trend Micro OfficeScan Corporate Edition 3.13 Trend Micro OfficeScan Corporate Edition 3.11 Trend Micro OfficeScan Corporate Edition 3.5 Trend Micro OfficeScan Corporate Edition 3.0 Trend Micro InterScan WebProtect for ISA Trend Micro InterScan WebManager 2.1 Trend Micro InterScan WebManager 2.0 Trend Micro InterScan WebManager 1.2 Trend Micro InterScan WebManager 1.2 Trend Micro InterScan Web Security Suite for Windows Trend Micro InterScan Web Security Suite for Solaris Trend Micro InterScan Web Security Suite for Linux Trend Micro InterScan VirusWall for Windows NT 5.1 Trend Micro InterScan VirusWall for Windows NT 3.52 build 1466 Trend Micro InterScan VirusWall for Windows NT 3.52 Trend Micro InterScan VirusWall for Windows NT 3.51 Trend Micro InterScan VirusWall for Windows NT 3.6 Trend Micro InterScan VirusWall for Windows NT 3.5 Trend Micro InterScan VirusWall for Windows NT 3.4 Trend Micro InterScan VirusWall for Windows Trend Micro InterScan VirusWall for Unix 3.6 x Trend Micro InterScan VirusWall for Unix 3.0.1 Trend Micro InterScan VirusWall for SMB Windows NT Trend Micro InterScan VirusWall for SMB Linux Trend Micro InterScan VirusWall for SMB Trend Micro InterScan VirusWall for AIX Trend Micro Interscan Viruswall (Solaris) 3.6 Trend Micro Interscan Viruswall (Linux) 3.6 Trend Micro Interscan Viruswall (Linux) 3.0.1 Trend Micro Interscan Viruswall (HP-UX) 3.6 Trend Micro InterScan Messaging Security Suite for Windows Trend Micro InterScan Messaging Security Suite for Solaris Trend Micro InterScan Messaging Security Suite for Linux Trend Micro InterScan Messaging Security Suite 5.5 Trend Micro InterScan Messaging Security Suite 3.81 Trend Micro InterScan eManager 3.51 j Trend Micro InterScan eManager 3.51 Trend Micro InterScan eManager 3.6 For Sun Trend Micro InterScan eManager 3.6 For Linux Trend Micro InterScan eManager 3.5.2 For Windows Trend Micro InterScan eManager 3.5 For HP Trend Micro Control Manager Windows Trend Micro Control Manager Win NT/2000 Trend Micro Control Manager Solaris Trend Micro Control Manager S/390 Trend Micro Control Manager NetWare Trend Micro Control Manager AS/400 Trend Micro Client/Server/Messaging Suite for SMB for Windows Trend Micro Client/Server Suite for SMB for Windows |
| Not Vulnerable: | |
Discussion
Trend Micro VSAPI ARJ Handling Heap Overflow Vulnerability
The Trend Micro VSAPI scan engine library is prone to a heap-based buffer overflow vulnerability. This vulnerability may be triggered when the library processes a malformed ARJ archive.
The vulnerability affects multiple Trend Micro products. It is also noted that multiple attack vectors exist, as affected software may scan ARJ files in email attachments, and through various file transfer protocols.
The Trend Micro VSAPI scan engine library is prone to a heap-based buffer overflow vulnerability. This vulnerability may be triggered when the library processes a malformed ARJ archive.
The vulnerability affects multiple Trend Micro products. It is also noted that multiple attack vectors exist, as affected software may scan ARJ files in email attachments, and through various file transfer protocols.
Exploit / POC
Trend Micro VSAPI ARJ Handling Heap Overflow Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Trend Micro VSAPI ARJ Handling Heap Overflow Vulnerability
Solution:
Upgrading to scan engine VSAPI 7.510 or higher will address this vulnerability. Engine upgrades can be obtained at http://www.trendmicro.com/download/engine.asp
Solution:
Upgrading to scan engine VSAPI 7.510 or higher will address this vulnerability. Engine upgrades can be obtained at http://www.trendmicro.com/download/engine.asp
References
Trend Micro VSAPI ARJ Handling Heap Overflow Vulnerability
References:
References:
- Scan Engine Updates (Trend Micro)
- Trend Micro AntiVirus Library Heap Overflow (Internet Security Systems)
- Vulnerability in VSAPI ARJ parsing could allow Remote Code execution (Trend Micro)