TrendMicro AntiVirus UUE Processing Vulnerability<br><br><br>Sowhat of Nevis Labs<br><a href="http://www.nevisnetworks.com">http://www.nevisnetworks.com</a><br><a href="http://secway.org/advisory/AD20071211.txt">http://secway.org/advisory/AD20071211.txt
</a><br><br><br>Vendor:<br>TrendMicro<br><br><br>Affected:<br>TrendMicro Antivirus prior to PccScan.dll build 1451<br>This vulnerability has been confirmed on TrendMicro Antivirus and Antispyware 20008<br>(PccScan.dll build 1450).
<br><br><br><br>Details:<br><br>There is a vulnerability in TrendMicro Antivirus, which allows an attacker<br>to escalate to SYSTEM privilege, Denial of service, or potential execute arbitrary <br>code (not confirmed yet).
<br><br>While decoding the .uue file., TrendMicro Antivirus will create a .zip file, <br>by manipulating the .uue file, we can make the TrendMicro AV generate a .zip file<br>which contains a long file name.<br><br>Due to the incorrect usage of wcsncpy_s() API while
PccScan.dll is trying to copy <br>this long file name into a static buffer, the SfCtlCom.exe will crash.<br><br>Because SfCtlCom.exe is running under SYSTEM privilege, local privilege is possible<br>in some cases, e.g. there is a just-in-time debugger presented.
<br><br>The remote exploitability has not been confirmed yet.<br><br>And also, According to the vendor:<br>"malformed UUE is not necessary, just a malformed zip file is enough"<br><br>So this vulnerability should be called as a ".ZIP processing vulnerability", not .UUE
<br><br>The vulnerability can be exploited remotely, by sending Email or convince the <br>victim visit attacker controlled website. Or can be exploited locally to gain the <br>SYSTEM privilege.<br><br><br>Vendor Response:
<br><br>2007.11.12 Vendor notified through several email address.<br>2007.11.13 Auto-Response from the support.<br>2007.11.13 Get the right person by sending emails to FD<br>2007.11.23 Patch available<br>2007.12.05
Patch planned on 5th, Dec<br>2007.12.06 Patch delayed to 7th, Dec<br>2007.12.11 Patch released by the vendor<br>2007.12.11 Advisory released.<br><br>Reference:<br>1. <a href="http://esupport.trendmicro.com/support/viewxml.do?ContentID=1036464">
http://esupport.trendmicro.com/support/viewxml.do?ContentID=1036464</a><br>2. <a href="http://secway.org/advisory/AD20071116.txt">http://secway.org/advisory/AD20071116.txt</a><br>3. <a href="http://groups.google.com/group/vulnhashdb">
http://groups.google.com/group/vulnhashdb</a><br><br><br clear="all"><br>-- <br>Sowhat<br><a href="http://secway.org">http://secway.org</a><br>"Life is like a bug, Do you know how to exploit it ?"<br><br>