TITLE:
Trend Micro Products AntiVirus Library Buffer Overflow

SECUNIA ADVISORY ID:
SA14396

VERIFY ADVISORY:
http://secunia.com/advisories/14396/

CRITICAL:
Highly critical

IMPACT:
System access

WHERE:
>From remote

SOFTWARE:
Trend Micro ServerProtect for Windows/NetWare 5.x
http://secunia.com/product/1153/
Trend Micro ServerProtect for Linux 1.x
http://secunia.com/product/4712/
Trend Micro ScanMail for Microsoft Exchange 6.x
http://secunia.com/product/67/
Trend Micro ScanMail for Microsoft Exchange 3.x
http://secunia.com/product/66/
Trend Micro ScanMail for Lotus Notes 3.x
http://secunia.com/product/4711/
Trend Micro ScanMail for Lotus Notes 2.x
http://secunia.com/product/1021/
Trend Micro ScanMail eManager 5.x
http://secunia.com/product/4710/
Trend Micro ScanMail eManager 3.x
http://secunia.com/product/68/
Trend Micro PortalProtect for SharePoint 1.x
http://secunia.com/product/4709/
Trend Micro PC-cillin Internet Security 2005
http://secunia.com/product/4708/
Trend Micro PC-cillin 2003
http://secunia.com/product/853/
Trend Micro PC-cillin 2002
http://secunia.com/product/852/
Trend Micro PC-cillin 2000
http://secunia.com/product/851/
Trend Micro OfficeScan Corporate Edition 6.x
http://secunia.com/product/4323/
Trend Micro OfficeScan Corporate Edition 5.x
http://secunia.com/product/854/
Trend Micro OfficeScan Corporate Edition 3.x
http://secunia.com/product/855/
Trend Micro InterScan WebProtect for ISA 3.x
http://secunia.com/product/65/
Trend Micro InterScan WebManager 2.x
http://secunia.com/product/64/
Trend Micro InterScan Web Security Suite 2.x
http://secunia.com/product/4086/
Trend Micro InterScan Web Security Suite 1.x
http://secunia.com/product/4085/
Trend Micro InterScan VirusWall 3.x
http://secunia.com/product/60/
Trend Micro InterScan Messaging Security Suite 5.x
http://secunia.com/product/61/
Trend Micro InterScan eManager 3.x
http://secunia.com/product/62/

DESCRIPTION:
ISS X-Force has reported a vulnerability in various Trend Micro
products, which can be exploited by malicious people to compromise a
vulnerable system.

The vulnerability is caused due to a boundary error in the AntiVirus
library when processing ARJ files. This can be exploited to cause a
heap-based buffer overflow via a specially crafted ARJ file
containing an overly long filename.

Successful exploitation allows execution of arbitrary code.

The vulnerability affects the following products:
* Trend Micro Client / Server / Messaging Suite for SMB for Windows
* Trend Micro Client / Server Suite for SMB for Windows
* Trend Micro InterScan eManager
* Trend Micro InterScan Messaging Security Suite for Linux
* Trend Micro InterScan Messaging Security Suite for Solaris
* Trend Micro InterScan Messaging Security Suite for Windows
* Trend Micro InterScan VirusWall for AIX
* Trend Micro InterScan VirusWall for HP-UX
* Trend Micro InterScan VirusWall for Linux
* Trend Micro InterScan VirusWall for SMB
* Trend Micro InterScan VirusWall for Solaris
* Trend Micro InterScan VirusWall for Windows
* Trend Micro InterScan Web Security Suite for Linux
* Trend Micro InterScan Web Security Suite for Solaris
* Trend Micro InterScan Web Security Suite for Windows
* Trend Micro InterScan WebManager
* Trend Micro InterScan WebProtect for ISA
* Trend Micro OfficeScan Corp. Edition
* Trend Micro PC-cillin Internet Security
* Trend Micro PortalProtect for SharePoint
* Trend Micro ScanMail eManager
* Trend Micro ScanMail for Lotus Domino on AIX
* Trend Micro ScanMail for Lotus Domino on AS/400
* Trend Micro ScanMail for Lotus Domino on S/390
* Trend Micro ScanMail for Lotus Domino on Solaris
* Trend Micro ScanMail for Lotus Domino on Windows
* Trend Micro ScanMail for Microsoft Exchange
* Trend Micro ServerProtect for Linux
* Trend Micro ServerProtect for Windows

SOLUTION:
Update scan engine to VSAPI 7.510 or later.
http://www.trendmicro.com/download/engine.asp

PROVIDED AND/OR DISCOVERED BY:
Alex Wheeler, ISS X-Force.

ORIGINAL ADVISORY:
Trend Micro:
http://www.trendmicro.com/vinfo/secadvisories/default6.asp?VName=Vulnerability+in+VSAPI+ARJ+parsing+could+allow+Remote+Code+execution

ISS X-Force:
http://xforce.iss.net/xforce/alerts/id/189

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------