[security-alerts] FW: [SA26523] Trend Micro ServerProtect Multiple Buffer Overflow Vulnerabilities

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

>
> TITLE:
> Trend Micro ServerProtect Multiple Buffer Overflow Vulnerabilities
>
> SECUNIA ADVISORY ID:
> SA26523
>
> VERIFY ADVISORY:
> http://secunia.com/advisories/26523/
>
> CRITICAL:
> Moderately critical
>
> IMPACT:
> System access
>
> WHERE:
> From local network
>
> SOFTWARE:
> Trend Micro ServerProtect for Windows/NetWare 5.x
> http://secunia.com/product/1153/
>
> DESCRIPTION:
> Some vulnerabilities have been reported in Trend Micro ServerProtect,
> which can be exploited by malicious people to compromise a vulnerable
> system.
>
> 1) An integer overflow error within the RPCFN_SYNC_TASK function in
> StRpcSrv.dll can be exploited to cause a heap-based buffer overflow
> via a specially crafted RPC request to SpntSvc.exe on default port
> 5168/TCP.
>
> 2) Boundary errors within the RPCFN_ENG_NewManualScan,
> RPCFN_ENG_TimedNewManualScan, and RPCFN_SetComputerName functions in
> StRpcSrv.dll can be exploited to cause stack-based buffer overflows
> via specially crafted RPC requests to SpntSvc.exe on default port
> 5168/TCP.
>
> 3) Boundary errors within the RPCFN_CMON_SetSvcImpersonateUser and
> RPCFN_OldCMON_SetSvcImpersonateUser functions in Stcommon.dll can be
> exploited to cause stack-based buffer overflows via specially crafted
> RPC requests to SpntSvc.exe on default port 5168/TCP.
>
> 4) Boundary errors within the RPCFN_ENG_TakeActionOnAFile and
> RPCFN_ENG_AddTaskExportLogItem functions in Eng50.dll can be
> exploited to cause heap- and stack-based buffer overflows via
> specially crafted RPC requests to SpntSvc.exe on default port
> 5168/TCP.
>
> 5) A boundary error within the NTF_SetPagerNotifyConfig function in
> Notification.dll can be exploited to cause a stack-based buffer
> overflow via a specially crafted RPC request to SpntSvc.exe on
> default port 5168/TCP.
>
> 6) A boundary error within the RPCFN_CopyAUSrc function in the Trend
> ServerProtect Agent service can be exploited to cause a stack-based
> buffer overflow via a specially crafted RPC request sent to default
> port 3628/TCP.
>
> 7) Boundary errors within the RPCFN_EVENTBACK_DoHotFix and
> CMD_CHANGE_AGENT_REGISTER_INFO in earthagent.exe can be exploited to
> cause buffer overflows.
>
> Successful exploitation of the vulnerabilities allows execution of
> arbitrary code.
>
> The vulnerabilities are reported in ServerProtect for Windows version
> 5.58 Build 1176. Other versions may also be affected.
>
> SOLUTION:
> Apply Security Patch 4 - Build 1185.
> http://www.trendmicro.com/ftp/products/patches/spnt_558_win_en
> _securitypatch4.exe
>
> PROVIDED AND/OR DISCOVERED BY:
> 1-6) Reported via iDefense Labs by:
> * Code Audit Labs
> * Two anonymous researchers
> * Jun Mao, iDefense Labs
> 7) Reported by the vendor.
>
> ORIGINAL ADVISORY:
> Trend Micro:
> http://www.trendmicro.com/ftp/documentation/readme/spnt_558_wi
> n_en_securitypatch4_readme.txt
>
> iDefense Labs:
> http://labs.idefense.com/intelligence/vulnerabilities/display.
> php?id=588
> http://labs.idefense.com/intelligence/vulnerabilities/display.
> php?id=587
>