Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2007.0172 -- [Win]
Trend Micro Antivirus UPX Parsing Kernel Divide by Zero Vulnerability
15 March 2007
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Trend Micro AntiVirus
Publisher: iDefense
Operating System: Windows
Impact: Denial of Service
Access: Remote/Unauthenticated
Original Bulletin:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=488
- --------------------------BEGIN INCLUDED TEXT--------------------
Trend Micro Antivirus UPX Parsing Kernel Divide by Zero Vulnerability
iDefense Security Advisory 03.14.07
http://labs.idefense.com/intelligence/vulnerabilities/
Mar 14, 2007
I. BACKGROUND
Trend Micro AntiVirus is an virus scanning engine included in a wide array
of products by Trend Micro. Several examples of vulnerable products
include PC-cillin and Internet Security Suite.
http://www.trendmicro.com/en/home/us/home.htm
II. DESCRIPTION
Remote exploitation of a divide by zero error in Trend Micro AntiVirus may
allow attackers to cause a denial of service.
The vulnerability exists in the kernel driver, VsapiNT.sys. This driver is
responsible for scanning various file formats for malicious content. The
code that parses UPX files takes an integer value from an attacker
supplied file and uses it as a divisor. This results in a divide by zero
error in kernel mode. This causes a kernel fault resulting in a blue
screen of death (BSOD).
III. ANALYSIS
Exploitation of this vulnerability results not only in a DOS of the Trend
Micro process, but in an operating system crash.
There are several different attack vectors depending on which product is
being targeted. Someone targeting a home user would need to convince a
user to download a file from a website or an attachment from an email
message. The user would then need to manually scan this file or save it
and have the Trend Micro auto scan process scan it at some later time. If
instead a mail gateway is being targeted this vulnerability can be
exploited automatically by sending a malicious attachment through a
gateway that uses Trend Micro to scan content.
IV. DETECTION
iDefense has confirmed the existence of this vulnerability in Trend Micro
AntiVirus version 14.10.1041, engine version 8.320.1003. Previous versions
may also be affected.
V. WORKAROUND
iDefense is currently unaware of any workarounds for this issue.
VI. VENDOR RESPONSE
"To address this vulnerability, Trend Micro recommends customers to update
to Virus Pattern File 4.335.00 or higher."
For more information, consult the Trend Micro Knowledge Base article at
the link shown below.
http://esupport.trendmicro.com/support/viewxml.do?ContentID=EN-1034587
VII. CVE INFORMATION
A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not
been assigned yet.
VIII. DISCLOSURE TIMELINE
02/27/2007 Initial vendor notification
02/27/2007 Initial vendor response
03/14/2007 Coordinated public disclosure
IX. CREDIT
The discoverer of this vulnerability wishes to remain anonymous.
Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php
Free tools, research and upcoming events
http://labs.idefense.com/
X. LEGAL NOTICES
Copyright © 2007 iDefense, Inc.
Permission is granted for the redistribution of this alert electronically.
It may not be edited in any way without the express written consent of
iDefense. If you wish to reprint the whole or any part of this alert in
any other medium other than electronically, please e-mail
customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate at
the time of publishing based on currently available information. Use of
the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on, this
information.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBRfizzSh9+71yA2DNAQINeAP/T8rOG6jaoA/QIq+oJuqz0JWikvREZv4N
B0Hp/eNhtCXNsHuFR5m6ndfcn1Kv3h1JzX34UacyIwXsj/LlUmY+eYFY5/EZOi22
Y4Or+QJvgLZacAZdh9XhhfnNTEresJvT0EELdeHHB69589zKwC3hpU2qzaTgVMqQ
bOA8+JQCb3I=
=Mznf
-----END PGP SIGNATURE-----