Trend Micro Virus Control System Denial Of Service Vulnerability

Bugtraq ID:	6617
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Jan 15 2003 12:00AM
Updated:	Jan 15 2003 12:00AM
Credit:	Discovery of this vulnerability credited to Rod Boron <[email protected]>.
Vulnerable:	Trend Micro Virus Control System 1.8 - Microsoft IIS 4.0 - Microsoft IIS 3.0 - Microsoft IIS 2.0 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0
Not Vulnerable:	Trend Micro Control Manager 2.5

Trend Micro Virus Control System Denial Of Service Vulnerability

A denial of service vulnerability has been reported for Trend Micro TVCS. The vulnerability occurs when numerous requests for 'activesupport.exe' are made. This will cause the web server to stop responding to requests for a limited period of time. Repeated requests will cause a denial of service for an indefinite period of time.

Trend Micro Virus Control System Denial Of Service Vulnerability

The following proof of concept was provided:

http://x.x.x.x/tvcs/activesupport.exe

Trend Micro Virus Control System Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Trend Micro Virus Control System Denial Of Service Vulnerability

References:

• Trend Micro Control Manager (Trend Micro)