Trend Micro Interscan Viruswall Multiple Program Buffer Overflow Vulnerability

Bugtraq ID:	2579
Class:	Boundary Condition Error
CVE:	CVE-2001-0432
Remote:	Yes
Local:	No
Published:	Apr 13 2001 12:00AM
Updated:	Jul 11 2009 06:06AM
Credit:	This vulnerability was announced to Bugtraq in an Eeye Security Advisory on April 13, 2001.
Vulnerable:	Trend Micro Interscan Viruswall (Linux) 3.0.1 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - SuSE Linux 7.0 - SuSE Linux 6.4 - Turbolinux Turbolinux 6.1
Not Vulnerable:	Trend Micro Interscan Viruswall (Linux) 3.6 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - SuSE Linux 7.0 - SuSE Linux 6.4 - Turbolinux Turbolinux 6.1

Trend Micro Interscan Viruswall Multiple Program Buffer Overflow Vulnerability

Interscan Viruswall is a Virus scanning software package distributed and maintained by Trend Micro. It is designed to scan for virus occurances in both incoming and outgoing traffic via SMTP, FTP, and HTTP at the gateway of the network.

A problem with the software package could lead elevated privileges on the scanning system. The management interface used with the Interscan Viruswall uses several programs in a cgi directory that contain buffer overflows. Additionally, the http daemon used to execute these programs runs as root, and does not sufficiently control access to the programs, allowing a user to execute them directly.

Therefore, it is possible for a remote user to exploit buffer overflows in the cgi programs packaged with Interscan Viruswall, and execute arbitrary commands are root on the system hosting Viruswall.

Trend Micro Interscan Viruswall Multiple Program Buffer Overflow Vulnerability

http://server:1812/catinfo?4500xA

Trend Micro Interscan Viruswall Multiple Program Buffer Overflow Vulnerability

Solution:
Upgrade available:


Trend Micro Interscan Viruswall (Linux) 3.0.1

• Trend Micro Interscan Viruswall 3.6 (Linux)
  http://www.trend.com/support/

Trend Micro Interscan Viruswall Multiple Program Buffer Overflow Vulnerability

References: