Greetings!

I have submitted this case to our Product Specialist=2E We'll update you=
for the progress=2E

Regards,
Raymond F=2E Villafania
Systems Engineer
TrendLabs HQ, Trend Micro Incorporated
=20

-----Original Message-----
From: Rainer Link (ADM-EU)=20
Sent: Thursday, February 28, 2008 5:48 AM
To: Vulnerability Claim
Subject: WG: Buffer-overflow in the passwords handling of Trend Micro=
OfficeScan 8=2E0 and possibly other products


Please take care of it ASAP - please check if other products are affected=
as well=2E

Thank you=2E


cheers, Rainer

-----Urspr=FCngliche Nachricht-----
Von: Luigi Auriemma [mailto:aluigi@autistici=2Eorg]
Gesendet: Mi 27=2E02=2E2008 20:30
An: bugtraq@securityfocus=2Ecom; news@securiteam=2Ecom;=
full-disclosure@lists=2Egrok=2Eorg=2Euk; vuln@secunia=2Ecom;=
packet@packetstormsecurity=2Eorg
Betreff: Buffer-overflow in the passwords handling of Trend Micro=
OfficeScan 8=2E0 and possibly other products
=20

################################################## #####################

Luigi Auriemma

Application: Trend Micro OfficeScan Corporate Edition
http://us=2Etrendmicro=
=2Ecom/us/products/enterprise/officescan-client-server-edition/
other Trend Micro products could be affected by this
vulnerability since it's located in a function used to
decrypt a specific type of passwords used by this vendor
Versions: <=3D v8=2E0 Patch 2 - build 1189
<=3D v7=2E3 Patch 3 - build 1314
Platforms: Windows
Bugs: A] buffer-overflow in the decryption function of the
passwords
B] endless dead processes
Exploitation: remote
(no tests have been performed to check for a possible
local exploiting of the vulnerability on the clients
machines for killing the antivirus or the monitor
processes or escalating privileges)
Date: 27 Feb 2008
Author: Luigi Auriemma
e-mail: aluigi@autistici=2Eorg
web: aluigi=2Eorg


################################################## #####################


1) Introduction
2) Bugs
3) The Code
4) Fix


################################################## #####################

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
1) Introduction
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D


OfficeScan is an anti-virus client and server developed by Trend Micro=2E
The server is mainly a set of CGIs, ActiveX and web pages which run on
a pre-existent web server or on the included Apache installation=2E

As already written in the header of this advisory the vulnerability
could affect other products too=2E


################################################## #####################

=3D=3D=3D=3D=3D=3D=3D
2) Bugs
=3D=3D=3D=3D=3D=3D=3D

--------------------------------------------------------------
A] buffer-overflow in the decryption function of the passwords
--------------------------------------------------------------

The first time I saw the so called OfficeScan's passwords was almost
two years ago and in short they are just MD5 hashes of the original
password plus an additional encryption, but I was never interested to
go deeper in the matter and I don't know if something has been changed
from that time=2E
I wrote something incomplete about them a lot of time ago in case
someone is curious or want to add something:
http://aluigi=2Eorg/pwdrec/officescan_pwdmd5=2Etxt

The function for decrypting these data is ever the same one used in
"any" program that needs to handle this type of passwords, so the CGIs
which read the password of the admin/user who wants to log in the web
management (for example cgiChkMasterPwd=2Eexe), the PolicyServer
(policyserver=2Eexe which receives the client's password from the
cgiABLogon=2Eexe CGI) and naturally the same server and all the clients=2E

In short the function verifies that the input password starts with the
!CRYPT! string and then copies the subsequent data in a stack buffer of
512 bytes without verifying its correct length with the obvious result
of a buffer-overflow=2E

Not all the versions of OfficeScan can be exploited for executing
malicious code (7=2E3 is fully exploitable) because on some of them (like
the latest 8=2E0) the exception handler terminates the process if notices
a stack corruption and so in these cases the only effect can be a
Denial of Service (like what happens with the PolicyServer where current
and new users can no longer use the service, in fact although exists the
auto-restarting function it will not work until the dead process is not
killed or the error message acknowledged) or just a dead process which
will not affect the correct usage of the services=2E


-------------------------
B] endless dead processes
-------------------------

The following vulnerability is reported here only for thoroughness and
is very simple: a couple of NULL pointer vulnerabilities in the CGI
executables used by the server can be exploited to create endless dead
processes on the server causing a possible Denial of Service after many
of them=2E

These NULL pointers are caused by two factors: the lack of the
Content-Length field in the HTTP request and the usage of invalid
sequences of chars in the CGIs parameters (both of them have been
tested on the included Apache server)=2E


################################################## #####################

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
3) The Code
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D


http://aluigi=2Eorg/poc/officescaz=2Ezip

nc SERVER 8080 -v -v < officescaz1=2Etxt
nc SERVER 8080 -v -v < officescaz2=2Etxt
nc SERVER 8080 -v -v < officescaz3=2Etxt
nc SERVER 8080 -v -v < officescaz4=2Etxt


################################################## #####################

=3D=3D=3D=3D=3D=3D
4) Fix
=3D=3D=3D=3D=3D=3D


No fix


################################################## #####################


---=20
Luigi Auriemma
http://aluigi=2Eorg



TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential=
and may be subject to copyright or other intellectual property protection=
=2E If you are not the intended recipient, you are not authorized to use or=
disclose this information, and we request that you notify us by reply mail=
or telephone and delete the original message from your mail system=2E