Signature Detail

APP: Trend Micro OfficeScan Console Authentication Buffer Overflow

This signature detects attempts to exploit a known buffer overflow vulnerability in the way Trend Micro OfficeScan management console handles HTTP requests. It is due to lack of boundary protection while processing HTTP cookie strings. Remote unauthenticated attackers can exploit this to take complete control of an affected system. In an unsuccessful attack, the affected application suspends abnormally. The attacker might consume all the system resource by sending continuous requests and create a denial-of-service condition to the affected server. In a successful code injection attack, the behavior of the target is entirely dependent on the intended function of the injected code. The code in such a case would execute within the security context of the affected service.

Extended Description

Trend Micro OfficeScan Server is prone to a stack buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer. Successful exploits may allow an attacker to execute arbitrary code with privileges of the IIS webserver. This may facilitate a complete compromise of vulnerable servers. Failed exploit attempts will likely result in denial-of-service conditions. Versions prior to Trend Micro OfficeScan 8.0 patch build 1042 are confirmed affected by this issue. Client Server Messaging Security for SMB 3.0, 3.5, and 3.6 are also vulnerable. The authentication-bypass issue previously reported in this document has been assigned its own BID: 24935 Trend Micro OfficeScan Management Console Authentication Bypass Vulnerability.

Affected Products

• Trend Micro Client Server Messaging Security for SMB 3.0
• Trend Micro Client Server Messaging Security for SMB 3.5
• Trend Micro Client Server Messaging Security for SMB 3.6
• Trend Micro OfficeScan Corporate Edition 6.5
• Trend Micro OfficeScan Corporate Edition 7.0
• Trend Micro OfficeScan Corporate Edition 7.3
• Trend Micro OfficeScan Corporate Edition 8.0
• Trend Micro OfficeScan Corporate Edition for SMB2.0 6.0

References

• BugTraq: 24641
• CVE: CVE-2007-3454