Trend Micro OfficeScan Client Denial of Service Vulnerability

Bugtraq ID:	34642
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Apr 21 2009 12:00AM
Updated:	Apr 22 2009 11:46PM
Credit:	Juan Pablo Lopez Yacubian
Vulnerable:	Trend Micro OfficeScan 8.0 Service Pack 1 - Microsoft Windows 3.1 - Microsoft Windows 3.1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Novell Netware 4.11 - Novell Netware 4.11 - Novell Netware 4.1 - Novell Netware 4.1 Trend Micro OfficeScan 8.0 - Microsoft Windows 3.1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 - Novell Netware 4.11 - Novell Netware 4.1
Not Vulnerable:

Trend Micro OfficeScan Client Denial of Service Vulnerability

The Trend Micro OfficeScan Client is prone to a denial-of-service vulnerability because it fails to handle nested directories with excessively long names.

Successfully exploits will crash the affected application, resulting in a denial-of-service condition. Given the nature of this issue, code execution may be possible, but has not been confirmed.

OfficeScan 8.0 SP1 is vulnerable; other versions may also be affected.

Trend Micro OfficeScan Client Denial of Service Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/34642.zip

Trend Micro OfficeScan Client Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Trend Micro OfficeScan Client Denial of Service Vulnerability

References:

• Trend Micro Homepage (Trend Micro)
  
• Re: Trend Micro OfficeScan Client - DOS (Thierry Zoller )
  
• Trend Micro OfficeScan Client - DOS ([email protected])