[security-alerts] FW: [SA24243] Trend Micro ServerProtect Buffer Overflow Vulnerabilities

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> ----------------------------------------------------------------------
> 
> TITLE:
> Trend Micro ServerProtect Buffer Overflow Vulnerabilities
> 
> SECUNIA ADVISORY ID:
> SA24243
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/24243/
> 
> CRITICAL:
> Moderately critical
> 
> IMPACT:
> System access
> 
> WHERE:
> From local network
> 
> SOFTWARE:
> Trend Micro ServerProtect for EMC Celerra 5.x
> http://secunia.com/product/13528/
> Trend Micro ServerProtect for Network Appliance Filer 5.x
> http://secunia.com/product/13527/
> Trend Micro ServerProtect for Windows/NetWare 5.x
> http://secunia.com/product/1153/
> 
> DESCRIPTION:
> TippingPoint Security Research Team has reported some vulnerabilities
> in Trend Micro ServerProtect, which can be exploited by malicious
> people to compromise a vulnerable system.
> 
> 1) A boundary error within the "CMON_NetTestConnection()" function in
> StCommon.dll can be exploited to cause a stack-based buffer overflow
> via a specially crafted RPC request to the SpntSvc.exe service
> (default port 5168/TCP).
> 
> 2) Another boundary error within a function in StCommon.dll can be
> exploited to cause a stack-based buffer overflow via a specially
> crafted RPC request to the SpntSvc.exe service.
> 
> 3) A boundary error within the "ENG_SendEMail()" function in
> eng50.dll can be exploited to cause a stack-based buffer overflow via
> a specially crafted RPC request to the SpntSvc.exe service.
> 
> 4) Another boundary error within a function in eng50.dll can be
> exploited to cause a stack-based buffer overflow via a specially
> crafted RPC request to the SpntSvc.exe service.
> 
> Successful exploitation of the vulnerabilities allows execution of
> arbitrary code with SYSTEM privileges.
> 
> The vulnerabilities are reported in the following versions:
> * ServerProtect for Windows 5.58
> * ServerProtect for EMC 5.58
> * ServerProtect for Network Appliance Filer 5.61
> * ServerProtect for Network Appliance Filer 5.62
> 
> SOLUTION:
> Apply patches.
> 
> ServerProtect for Windows 5.58:
> Apply Security Patch 1- Build 1171 (English).
> http://www.trendmicro.com/download/product.asp?productid=17
> 
> ServerProtect for Windows 5.58 (Traditional Chinese):
> Patch should be available on 2007-02-27.
> 
> ServerProtect for Windows 5.58 (Simplified Chinese):
> Patch should be available on 2007-03-05.
> 
> ServerProtect for EMC 5.58 (English):
> Patch should be available on 2007-03-19.
> 
> ServerProtect for Network Appliance Filer 5.61 (English):
> Patch should be available on 2007-03-29.
> 
> ServerProtect for Windows 5.58 (Japanese):
> Patch release date not available yet.
> 
> ServerProtect for Network Appliance Filer 5.61 (Japanese):
> Patch release date not available yet.
> 
> ServerProtect for Network Appliance Filer 5.62 (Japanese):
> Patch release date not available yet.
> 
> PROVIDED AND/OR DISCOVERED BY:
> Pedram Amini, TippingPoint Security Research Team.
> 
> ORIGINAL ADVISORY:
> Trend Micro:
> http://esupport.trendmicro.com/support/viewxml.do?ContentID=EN-1034290
> 
> TippingPoint:
> http://www.tippingpoint.com/security/advisories/TSRT-07-01.html
> http://www.tippingpoint.com/security/advisories/TSRT-07-02.html
>