----------------------------------------------------------------------

Did you know that a change in our assessment rating, exploit code
availability, or if an updated patch is released by the vendor, is
not part of this mailing-list?

Click here to learn more:
https://secunia.com/advisories/business_solutions/

----------------------------------------------------------------------

TITLE:
Trend Micro OfficeScan Client Firewall Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA33609

VERIFY ADVISORY:
https://secunia.com/advisories/33609/

CRITICAL:
Less critical

IMPACT:
Security Bypass, Privilege escalation, DoS

WHERE:
Local system

SOFTWARE:
Trend Micro OfficeScan Corporate Edition 8.x
https://secunia.com/advisories/product/14630/

DESCRIPTION:
Secunia Research has discovered some vulnerabilities in Trend Micro
OfficeScan Client, which can be exploited by malicious, local users
to cause a DoS (Denial of Service), bypass certain security features,
and potentially gain escalated privileges.

1) Input validation errors exist in the OfficeScan NT Firewall
service (TmPfw.exe) within the "ApiThread()" function when processing
packets sent to the service (by default port 40000/TCP). These can be
exploited to cause heap-based buffer overflows via specially crafted
packets containing a small value in a size field.

Successful exploitation may allow execution of arbitrary code with
SYSTEM privileges.

2) Input validation errors exist in the OfficeScan NT Firewall
service (TmPfw.exe) within the "ApiThread()" function when processing
packets sent to the service (by default port 40000/TCP). These can be
exploited to crash the service via specially crafted packets
containing an overly large value in a size field.

3) Missing authentication to the OfficeScan NT Firewall service
(TmPfw.exe) listening on port 40000/TCP by default can be exploited
by any local user to manipulate the firewall configuration via
specially crafted packets regardless of whether password restriction
has been enabled for the configuration interface.

The vulnerabilities are confirmed in version 8.0 SP1 Patch 1. Other
versions may also be affected.

SOLUTION:
Apply patch:
https://www.trendmicro.com/ftp/products/patches/OSCE_8.0_SP1_Patch1_Win_EN_CriticalPatch_B3191.exe

PROVIDED AND/OR DISCOVERED BY:
Carsten Eiram, Secunia Research.

ORIGINAL ADVISORY:
Secunia Research:
https://secunia.com/secunia_research/2008-42/
https://secunia.com/secunia_research/2008-43/

Trend Micro:
https://www.trendmicro.com/ftp/documentation/readme/OSCE8.0_SP1_Patch1_CriticalPatch_3191_Readme.txt

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
https://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
https://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------