Trend Micro OfficeScan Server CGI Modules Stack Buffer Overflow Vulnerability

Bugtraq ID:	24641
Class:	Boundary Condition Error
CVE:	CVE-2007-3454
Remote:	Yes
Local:	No
Published:	Jun 26 2007 12:00AM
Updated:	Jul 17 2007 07:56PM
Credit:	An anonymous researcher working with iDefense Labs is credited with discovering this issue.
Vulnerable:	Trend Micro OfficeScan Corporate Edition for SMB2.0 6.0 Trend Micro OfficeScan Corporate Edition 8.0 Trend Micro OfficeScan Corporate Edition 7.3 Trend Micro OfficeScan Corporate Edition 7.0 Trend Micro OfficeScan Corporate Edition 6.5 Trend Micro Client Server Messaging Security for SMB 3.6 Trend Micro Client Server Messaging Security for SMB 3.5 Trend Micro Client Server Messaging Security for SMB 3.0
Not Vulnerable:

Trend Micro OfficeScan Server CGI Modules Stack Buffer Overflow Vulnerability

Trend Micro OfficeScan Server is prone to a stack buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.

Successful exploits may allow an attacker to execute arbitrary code with privileges of the IIS webserver. This may facilitate a complete compromise of vulnerable servers. Failed exploit attempts will likely result in denial-of-service conditions.

Versions prior to Trend Micro OfficeScan 8.0 patch build 1042 are confirmed affected by this issue. Client Server Messaging Security for SMB 3.0, 3.5, and 3.6 are also vulnerable.

The authentication-bypass issue previously reported in this document has been assigned its own BID: 24935 Trend Micro OfficeScan Management Console Authentication Bypass Vulnerability.

Trend Micro OfficeScan Server CGI Modules Stack Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Trend Micro OfficeScan Server CGI Modules Stack Buffer Overflow Vulnerability

Solution:
Trend Micro released fixes to address this issue. Please see the references for more information.


Trend Micro Client Server Messaging Security for SMB 3.5

• Trend Micro csm_35_osce_75_win_en_securitypatch_b1152.exe
  http://www.trendmicro.com/ftp/products/patches/csm_35_osce_75_win_en_s ecuritypatch_b1152.exe


• Trend Micro csm_36_osce_76_win_en_securitypatch_b1149.exe
  http://www.trendmicro.com/ftp/products/patches/csm_36_osce_76_win_en_s ecuritypatch_b1149.exe

Trend Micro Client Server Messaging Security for SMB 3.0

• Trend Micro csm_30_osce_72_win_en_securitypatch_b1209.exe
  http://www.trendmicro.com/ftp/products/patches/csm_30_osce_72_win_en_s ecuritypatch_b1209.exe

Trend Micro OfficeScan Corporate Edition 8.0

• Trend Micro Trend Micro OfficeScan security patch 1042
  http://www.trendmicro.com/ftp/products/patches/osce_80_win_en_security patch_b1042.exe

Trend Micro OfficeScan Server CGI Modules Stack Buffer Overflow Vulnerability

References:

• Trend Micro OfficeScan Homepage (Trend Micro)
  
• iDefense Security Advisory 07.16.07: Trend Micro OfficeScan Session Cookie Buffe (iDefense Labs )
  
• Trend Micro OfficeScan Corporate Edition 8.0 Security Patch - Build 1042 CGI mod (Trend Micro)