Trend Micro AntiVirus Engine Tmxpflt.SYS Local Buffer Overflow Vulnerability

Bugtraq ID:	26209
Class:	Boundary Condition Error
CVE:	CVE-2007-4277
Remote:	No
Local:	Yes
Published:	Oct 25 2007 12:00AM
Updated:	Oct 26 2007 06:46PM
Credit:	Rubén Santamarta is credited with discovering this issue.
Vulnerable:	Trend Micro ServerProtect for Windows 5.58 Trend Micro ServerProtect for Windows Trend Micro ServerProtect for Novell Netware Trend Micro ServerProtect for Network Appliance Filer 5.62 Trend Micro ServerProtect for Network Appliance Filer 5.61 Trend Micro ServerProtect for Linux 1.2 Trend Micro ServerProtect for Linux Trend Micro ServerProtect for EMC 5.58 Trend Micro ServerProtect 5.5.8 Trend Micro ServerProtect 5.3.1 Trend Micro ServerProtect 5.58 Trend Micro Server Protect 5.58 Trend Micro PC-Cillin Internet Security 2007 Trend Micro OfficeScan For Microsoft SBS 4.5 - Microsoft Windows NT 4.0 Trend Micro OfficeScan Corporate Edition for Windows NT Server 3.13 - Microsoft Windows NT 4.0 Trend Micro OfficeScan Corporate Edition for Windows NT Server 3.11 - Microsoft Windows NT 4.0 Trend Micro OfficeScan Corporate Edition for Windows NT Server 3.5 - Microsoft Windows NT 4.0 Trend Micro OfficeScan Corporate Edition for Windows NT Server 3.1.1 - Microsoft Windows NT 4.0 Trend Micro OfficeScan Corporate Edition for Windows NT Server 3.0 - Microsoft Windows NT 4.0 Trend Micro OfficeScan Corporate Edition for SMB2.0 6.0 Trend Micro OfficeScan Corporate Edition 7.0 Trend Micro OfficeScan Corporate Edition 6.5 Trend Micro OfficeScan Corporate Edition 5.58 Trend Micro OfficeScan Corporate Edition 5.5 Trend Micro OfficeScan Corporate Edition 5.0 2 Trend Micro OfficeScan Corporate Edition 3.54 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Novell Netware 5.1 - Novell Netware 5.0 - Novell Netware 4.11 - Novell Netware 4.1 - Novell Netware 3.1.2 Trend Micro OfficeScan Corporate Edition 3.13 - Microsoft Windows 3.1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 - Novell Netware 4.11 - Novell Netware 4.1 Trend Micro OfficeScan Corporate Edition 3.11 - Microsoft Windows 3.1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 - Novell Netware 4.11 - Novell Netware 4.1 Trend Micro OfficeScan Corporate Edition 3.5 - Microsoft Windows 3.1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 - Novell Netware 4.11 - Novell Netware 4.1 Trend Micro OfficeScan Corporate Edition 3.0 - Microsoft Windows 3.1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 - Novell Netware 4.11 - Novell Netware 4.1 Trend Micro OfficeScan Corporate Edition 8.0.patch build 1042 Trend Micro OfficeScan Corporate Edition 8.0 Trend Micro OfficeScan Corporate Edition 7.3 Trend Micro OfficeScan Corporate Edition 7.3 Trend Micro OfficeScan Corporate Edition 7.0 Trend Micro OfficeScan Corporate Edition 6.5 Trend Micro OfficeScan Corporate Edition 6.0 Trend Micro Office Scan 7.3 Trend Micro Antivirus 2007 Trend Micro Anti-Spyware for Consumer 3.5
Not Vulnerable:

Trend Micro AntiVirus Engine Tmxpflt.SYS Local Buffer Overflow Vulnerability

Trend Micro AntiVirus engine is prone to a local buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.

Successful exploits may allow an attacker to execute arbitrary machine code with SYSTEM-level privileges and completely compromise affected computers. Failed exploit attempts could crash the computer, denying service to legitimate users.

Applications that incorporate 'Tmxpflt.sys' 8.320.1004 and 8.500.0.1002 from the AntiVirus engine are vulnerable, including Trend Micro PC-cillin Internet Security 2007, ServerProtect, and OfficeScan.

Trend Micro AntiVirus Engine Tmxpflt.SYS Local Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Trend Micro AntiVirus Engine Tmxpflt.SYS Local Buffer Overflow Vulnerability

Solution:
Trend Micro released updates to address this issue. Please see the references for more information.

Trend Micro AntiVirus Engine Tmxpflt.SYS Local Buffer Overflow Vulnerability

References:

• [Vulnerability Response] Buffer overflow in Scan Engine Tmxpflt.sys 8.320.1004 a (Trend Micro)
  
• Trend Micro Homepage (Trend Micro)
  
• iDefense Security Advisory 10.25.07: Trend Micro Tmxpflt.sys IOCTL 0xa0284403 (iDefense Labs )
  
• iDefense Security Advisory 10.25.07 (iDefense Labs)