bugtraq - Vulnerability in Trendmicro Officescan

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050728191810.30810.qmail@securityfocus.com>
Date: 28 Jul 2005 19:18:10 -0000
From: sylvain.roger@...ucom.fr
To: bugtraq@...urityfocus.com
Subject: Vulnerability in Trendmicro Officescan

I found a weakness in Trendmicro Office scan product which can be used by malicious people to fake a virus description.
The vulnerability has been tested with Officescan 5.58, VSApINT : 7.510-1002, TmFilter 7.510.0.1002, Pattern 2.749
The vulnerability is the shared section weaknesses. The Pop3Trap.Exe process has a shared section called "\BaseNamedObjects\Pop3trap_Info" which has bad security rights : everyone can execute, delete, write this section. This allows to change what is displayed to the user when an infected mail arrives. This may lead to "phishing" action, not sure how at the present time.

To reproduce the vulnerability
1. Launch Trendmicro officescan with pop3 module activated
2. Just use TestSS tool written by A. Cerrudo to write on shared section called \BaseNamedObjects\Pop3trap_Info
3. when writing to this section, receive an infected mail and look at what it displays
4. Just imagine what you can display ;-)
Other products may be vulnerable