Trend Micro OfficeScan DoS Vulnerabilities

TITLE: Trend Micro OfficeScan DoS Vulnerabilities
CLASS: Failure to Handle Exceptional Conditions
CVE: CAN-2000-0203
CAN-2000-0204
CAN-2000-0205<
REMOTE: Yes
LOCAL: No
PUBLISHED: Feb 26 2000 12:00AM
UPDATE: Feb 26 2000 12:00AM
CREDIT: Posted to Bugtraq on February 25, 2000 by Jeff Stevens <jstevens@umeme.maine.edu>.Additional information posted to Bugtraq by <gdn@neurocom.com>.
VULNERABLE:

Trend Micro OfficeScan Corporate Edition 3.13
-Microsoft Windows 3.1
-Microsoft Windows 2000 Professional
-Microsoft Windows 95
-Microsoft Windows 98
-Microsoft Windows NT 4.0
-Novell Netware 4.11
-Novell Netware 4.1
Trend Micro OfficeScan Corporate Edition 3.11
-Microsoft Windows 3.1
-Microsoft Windows 2000 Professional
-Microsoft Windows 95
-Microsoft Windows 98
-Microsoft Windows NT 4.0
-Novell Netware 4.11
-Novell Netware 4.1
Trend Micro OfficeScan Corporate Edition 3.5
-Microsoft Windows 3.1
-Microsoft Windows 2000 Professional
-Microsoft Windows 95
-Microsoft Windows 98
-Microsoft Windows NT 4.0
-Novell Netware 4.11
-Novell Netware 4.1
Trend Micro OfficeScan Corporate Edition 3.0
-Microsoft Windows 3.1
-Microsoft Windows 2000 Professional
-Microsoft Windows 95
-Microsoft Windows 98
-Microsoft Windows NT 4.0
-Novell Netware 4.11
-Novell Netware 4.1
NOT VULNERABLE:

Vai alla pagina originale su Security Focus

Discussion

Trend Micro OfficeScan is an antivirus software program which is deployable across an entire network. During the installation of the management software, the administrator is asked to choose between managing from a webserver or from a fileserver. If the webserver option is chosen, clients running OfficeScan are configured to listen to port 12345 in order to receive periodical database engine updates and other administrative commands from the OfficeScan manager.

There are several ways for an attacker to cause various denial of service conditions.

Sending random data to port 12345 can cause tmlisten.exe to either consume 100% of the CPU cycles or cause a Visual C++ error and crash the machine.

Furthermore, opening over 5 simultaneous connections to port 12345 while sending random data will cause the service to stop responding to requests. The service will have to be stopped and restarted on each client machine.

It has also been reported that it is possible to cause a denial of service condition by making a single malformed GET request to port 12345.

It is also possible for a local user to capture an administrative command by using a network sniffer. This command can then be modified and replayed against other clients to cause them to perform a variety of actions. Modifying the last two bytes of the request will change the client's response behaviour, including:

04: full uninstallation of the OfficeScan client
06: launch a scan
07: stop a scan

The client makes requests to a few CGI programs on the server, which respond with configuration information. One of these CGIs is cgiRqCfg.exe, which provides configuration details for scan behaviour.

If an attacker were to set up a webserver with the same IP address as the valid server, duplicate the valid server's OfficeScan file structure, and disable the valid server, it would be possible to perform a more subtle DoS by leaving the client installed but modifying the config files to restrict the file types scanned, (for example: setting the client to only scan .txt files) or to restrict the types of drives scanned (for example: disabling scanning on removable, fixed, and CD-ROM drives). It is also possible to cause the client to move any infected files to any location on the local machine.

It should also be noted that some intrusion detection systems may detect attacks against port 12345 as Back Orifice attempts, which has the potential to conceal the nature of these attacks.

Exploit

cgiRqCfg.exe provides to the client configuration settings which will disable scanning on all removable, fixed, and CDrom drives, and further will disable scanning for all files except those with the extension "YES IT's P0SS1bl3!"

cgiOnStart.exe will need to be put on the attacking webserver as the client expects it.

Tr3ndAtt4ck.sh will replay the request to the client, and may be launched from any machine. Modify for your installation and desired client response.

Trend Micro Officescan Denial of Service (tmosdos.zip) was contributed by Marc Ruef <marc.ruef@computec.ch>. This tool is a pre-compiled Windows binary with Visual Basic source.

Solution

Solution:
Trend Micro has released patches which rectify this issue. These patches are available at the following location:

http://www.antivirus.com/download/ofce_patch.htm


Trend Micro OfficeScan Corporate Edition 3.0


Trend Micro OfficeScan Corporate Edition 3.11

Trend Micro OfficeScan Corporate Edition 3.13

Trend Micro OfficeScan Corporate Edition 3.5

References

References:

PhpLog

BNLug Benevento Linux Users Group