Vulnerability Note VU#167739

Trend Micro InterScan eManager vulnerable to remotely exploitable buffer overflow

Overview

A remotely exploitable buffer overflow exists in Trend Micro InterScan eManager.

I. Description

Trend Micro InterScan eManager is an application that inspects email traffic flowing into and out of a network for confidential or inappropriate material entering and/or leaving the network. This application has the capability to inspect, modify, and/or block email at the border of the enterprise. Trend Micro InterScan eManager includes several dynamic link libraries which provide management features for the system administrator over an http interface. Some of these dynamic link libraries contain a remotely exploitable buffer overflow.

II. Impact

Remote intruders can execute arbitrary code with SYSTEM privileges in the Local System security context.

III. Solution

The following versions of InterScan eManager are affected.

InterScan eManager for NT Ver.3.51 (English)
InterScan eManager for NT Ver.3.51(Japanese)

These tests were performed on the following Operating Systems:

Windows NT 4.0 Server + SP6a [English]
Windows NT 4.0 Server + SP6a [Japanese]

A patch for InterScan eManager for NT Ver.3.51J is available from http://www.trendmicro.co.jp/esolution/solutionDetail.asp?solutionID=3142
A patch for InterScan eManager for NT Ver.3.51 is pending.

If console access via the web is not necessary, remove /eManager virtual directory with the use of Internet Service Manager.
Enable NTLM authentication using the Internet Service Manager. This will provide restricted access to Web-based console.
Restrict access to web-based console with the use of packet filtering technologies.
Systems Affected

Vendor Status Date Updated

Trend Micro Vulnerable 12-Sep-2001

References

http://www.trendmicro.co.jp/esolution/solutionDetail.asp?solutionID=3142
http://www.lac.co.jp/security/english/snsadv_e/42_e.html

Credit

This vulnerability was discovered by Little eArth Corporation Co., Ltd and was made public on September 12, 2001.

This document was written by Ian A. Finlay.

Other Information

Date Public	09/12/2001
Date First Published	09/13/2001 01:31:26 PM
Date Last Updated	09/13/2001
CERT Advisory
CVE-ID(s)
NVD-ID(s)
US-CERT Technical Alerts
Metric	33.75
Document Revision	51

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader