Vulnerability Note VU#488424

Trend Micro ServerProtect SpntSvc buffer overflow vulnerability

Original Release date: 09 May 2007 | Last revised: 14 May 2007

Overview

Trend Micro ServerProtect contains a buffer overflow vulnerability. This vulnerability may allow an attacker to execute arbitrary code on a vulnerable system.

Description

Trend Micro ServerProtect is an anti-virus application that is designed to run on Windows-based servers. The ServerProtect architecture includes a management console, information server, and the server which has ServerProtect installed.

The ServerProtect executable that runs on the server being protected by the anti-virus engine is called SpntSvc.exe.

The SpntSvc component contains a stack overflow vulnerability. An attacker may be able to trigger the overflow by sending a malformed RPC request to the SpntSvc process.

Impact

A remote, unauthenticated attacker may be able to execute arbitrary code with elevated privileges, or create a denial-of-service condition.

Solution

Update
Trend Micro has released ServerProtect 5.58 for Windows Security Patch 3- Build 1176 to address this vulnerability.


Restrict Access

Restricting network access to 5168/tcp to trusted hosts may mitigate this vulnerability.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
Trend MicroAffected-09 May 2007
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Thanks to the Zero Day Initiative for information that was used in this report. The Zero Day Initiative credits Eric DETOISIEN with discovery of this vulnerability.

This document was written by Ryan Giobbi.

Other Information

  • CVE IDs: CVE-2007-2508
  • Date Public: 07 May 2007
  • Date First Published: 09 May 2007
  • Date Last Updated: 14 May 2007
  • Severity Metric: 0.67
  • Document Revision: 8

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.