CVE-2005-0533
CVSS7.5
发布时间 :2005-05-02 00:00:00
修订时间 :2008-09-05 16:46:34
NMCOS    

[原文]Heap-based buffer overflow in Trend Micro AntiVirus Library VSAPI before 7.510, as used in multiple Trend Micro products, allows remote attackers to execute arbitrary code via a crafted ARJ file with long header file names that modify pointers within a structure.


[CNNVD]Trend Micro VSAPI ARJ文件处理堆溢出漏洞(CNNVD-200505-443)

        Trend Micro AntiVirus Library VSAPI 7.510之前的版本,当在多个Trend Micro产品中使用时,其包含的堆缓冲区溢出漏洞允许远程攻击者通过精心构建、带有较长头文件名且可以修改结构指针的ARJ文件来执行任意代码。

- CVSS (基础分值)

CVSS分值: 7.5 [严重(HIGH)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/a:trend_micro:interscan_viruswall:gold::windows
cpe:/a:trend_micro:interscan_viruswall:3.51::windows_nt
cpe:/a:trend_micro:control_manager:netware
cpe:/a:trend_micro:officescan:corporate_5.02
cpe:/a:trend_micro:officescan:corporate_3.11::windows_nt_server
cpe:/a:trend_micro:officescan:3.0::corporate
cpe:/a:trend_micro:officescan:corporate_3.5
cpe:/a:trend_micro:officescan:corporate_5.58
cpe:/a:trend_micro:interscan_emanager:3.51
cpe:/a:trend_micro:interscan_messaging_security_suite:gold::windows
cpe:/a:trend_micro:interscan_messaging_security_suite:5.5
cpe:/a:trend_micro:client-server-messaging_suite_smb:gold::windows
cpe:/a:trend_micro:scanmail:3.81::microsoft_exchange
cpe:/a:trend_micro:interscan_emanager:3.6::linux
cpe:/a:trend_micro:interscan_emanager:3.51_j
cpe:/a:trend_micro:interscan_webmanager:2.1
cpe:/a:trend_micro:pc-cillin:2003
cpe:/a:trend_micro:officescan:corporate_6.5
cpe:/a:trend_micro:officescan:corporate_3.13::windows_nt_server
cpe:/a:trend_micro:scanmail_emanager
cpe:/a:trend_micro:interscan_viruswall:3.6::windows_nt
cpe:/a:trend_micro:scanmail:gold::lotus_domino_on_aix
cpe:/a:trend_micro:control_manager:gold::windows
cpe:/a:trend_micro:officescan:corporate_3.54
cpe:/a:trend_micro:serverprotect:1.25_2007-02-16::linux
cpe:/a:trend_micro:interscan_viruswall:5.1::windows_nt
cpe:/a:trend_micro:interscan_web_security_suite:gold::solaris
cpe:/a:trend_micro:serverprotect:1.3::linux
cpe:/a:trend_micro:officescan:corporate_3.11
cpe:/a:trend_micro:interscan_messaging_security_suite:3.81
cpe:/a:trend_micro:officescan:corporate_3.5::windows_nt_server
cpe:/a:trend_micro:scanmail:3.8::microsoft_exchange
cpe:/a:trend_micro:pc-cillin:6.0
cpe:/a:trend_micro:officescan:corporate_5.5
cpe:/a:trend_micro:control_manager:gold::solaris
cpe:/a:trend_micro:interscan_emanager:3.5::hp
cpe:/a:trend_micro:officescan:corporate_3.0::windows_nt_server
cpe:/a:trend_micro:interscan_viruswall:3.52_build1466::windows_nt
cpe:/a:trend_micro:pc-cillin:2002
cpe:/a:trend_micro:interscan_viruswall:3.4::windows_nt
cpe:/a:trend_micro:interscan_viruswall:3.6::solaris
cpe:/a:trend_micro:interscan_messaging_security_suite:gold::solaris
cpe:/a:trend_micro:interscan_viruswall:3.0.1::unix
cpe:/a:trend_micro:interscan_emanager:3.5.2::windows
cpe:/a:trend_micro:interscan_messaging_security_suite:gold::linux
cpe:/a:trend_micro:interscan_viruswall:3.52::windows_nt
cpe:/a:trend_micro:scanmail:6.1::microsoft_exchange
cpe:/a:trend_micro:scanmail:gold::lotus_domino_on_s_390
cpe:/a:trend_micro:interscan_viruswall:3.6::unix
cpe:/a:trend_micro:interscan_viruswall:gold::aix
cpe:/a:trend_micro:interscan_viruswall:gold::smb
cpe:/a:trend_micro:scanmail:gold::lotus_domino_on_solaris
cpe:/a:trend_micro:officescan:corporate_3.1.1::windows_nt_server
cpe:/a:trend_micro:control_manager:gold::as_400
cpe:/a:trend_micro:interscan_viruswall:gold::linux_for_smb
cpe:/a:trend_micro:serverprotect:5.3.1
cpe:/a:trend_micro:interscan_viruswall:3.0.1::linux
cpe:/a:trend_micro:interscan_viruswall:3.6.5::linux
cpe:/a:trend_micro:interscan_viruswall:3.6::hp_ux
cpe:/a:trend_micro:control_manager:gold::windows_nt
cpe:/a:trend_micro:interscan_web_security_suite:gold::linux
cpe:/a:trend_micro:pc-cillin:2000
cpe:/a:trend_micro:portalprotect:1.0
cpe:/a:trend_micro:interscan_webmanager:1.2
cpe:/a:trend_micro:interscan_webprotect:gold::isa
cpe:/a:trend_micro:scanmail:2.51::domino
cpe:/a:trend_micro:scanmail:2.6::domino
cpe:/a:trend_micro:officescan:corporate_3.13
cpe:/a:trend_micro:serverprotect:2.5::linux
cpe:/a:trend_micro:interscan_viruswall:3.5::windows_nt
cpe:/a:trend_micro:scanmail:gold::lotus_domino_on_as_400
cpe:/a:trend_micro:client-server_suite_smb:gold::windows
cpe:/a:trend_micro:interscan_web_security_suite:gold::windows
cpe:/a:trend_micro:scanmail:gold::lotus_domino_on_windows
cpe:/a:trend_micro:interscan_emanager:3.6::sun
cpe:/a:trend_micro:interscan_webmanager:2.0
cpe:/a:trend_micro:interscan_viruswall:gold::windows_nt_for_smb
cpe:/a:trend_micro:control_manager:gold::s_390

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0533
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-0533
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200505-443
(官方数据源) CNNVD

- 其它链接及资源

http://www.trendmicro.com/vinfo/secadvisories/default6.asp?VName=Vulnerability+in+VSAPI+ARJ+parsing+could+allow+Remote+Code+execution
(PATCH)  CONFIRM  http://www.trendmicro.com/vinfo/secadvisories/default6.asp?VName=Vulnerability+in+VSAPI+ARJ+parsing+could+allow+Remote+Code+execution
http://www.securityfocus.com/bid/12643
(PATCH)  BID  12643
http://securitytracker.com/id?1013290
(VENDOR_ADVISORY)  SECTRACK  1013290
http://securitytracker.com/id?1013289
(VENDOR_ADVISORY)  SECTRACK  1013289
http://secunia.com/advisories/14396
(VENDOR_ADVISORY)  SECUNIA  14396
http://xforce.iss.net/xforce/alerts/id/189
(VENDOR_ADVISORY)  ISS  20050224 Trend Micro AntiVirus Library Heap Overflow

- 漏洞信息

Trend Micro VSAPI ARJ文件处理堆溢出漏洞
高危 缓冲区溢出
2005-05-02 00:00:00 2006-05-01 00:00:00
远程  
        Trend Micro AntiVirus Library VSAPI 7.510之前的版本,当在多个Trend Micro产品中使用时,其包含的堆缓冲区溢出漏洞允许远程攻击者通过精心构建、带有较长头文件名且可以修改结构指针的ARJ文件来执行任意代码。

- 公告与补丁

        暂无数据

- 漏洞信息

14133
Trend Micro Multiple Anti-Virus Products ARJ Archive Handling Overflow
Input Manipulation
Loss of Integrity

- 漏洞描述

Unknown or Incomplete

- 时间线

2005-02-24 Unknow
Unknow Unknow

- 解决方案

Unknown or Incomplete

- 相关参考

- 漏洞作者

Unknown or Incomplete

- 漏洞信息

Trend Micro VSAPI ARJ Handling Heap Overflow Vulnerability
Boundary Condition Error 12643
Yes No
2005-02-24 12:00:00 2009-07-12 10:56:00
Discovery is credited to Alex Wheeler.

- 受影响的程序版本

Trend Micro ServerProtect for Windows
Trend Micro ServerProtect for Novell Netware
Trend Micro ServerProtect for Linux 1.2
Trend Micro ServerProtect 5.3.1
Trend Micro ScanMail for Microsoft Exchange 6.1
Trend Micro ScanMail for Microsoft Exchange 3.81
Trend Micro ScanMail for Microsoft Exchange 3.8
Trend Micro ScanMail for Lotus Domino on Windows
Trend Micro ScanMail for Lotus Domino on Solaris
Trend Micro ScanMail for Lotus Domino on S/390
Trend Micro ScanMail for Lotus Domino on AS/400
Trend Micro ScanMail for Lotus Domino on AIX
Trend Micro ScanMail for Domino 2.51
Trend Micro ScanMail for Domino 2.6
Trend Micro ScanMail eManager
Trend Micro PortalProtect 1.0
Trend Micro PC-cillin 6.0
- Microsoft Windows 2000 Professional
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows NT 4.0
Trend Micro PC-cillin 2003
Trend Micro PC-cillin 2002
Trend Micro PC-cillin 2000
Trend Micro OfficeScan Corporate Edition for Windows NT Server 3.13
- Microsoft Windows NT 4.0
Trend Micro OfficeScan Corporate Edition for Windows NT Server 3.11
- Microsoft Windows NT 4.0
Trend Micro OfficeScan Corporate Edition for Windows NT Server 3.5
- Microsoft Windows NT 4.0
Trend Micro OfficeScan Corporate Edition for Windows NT Server 3.1.1
- Microsoft Windows NT 4.0
Trend Micro OfficeScan Corporate Edition for Windows NT Server 3.0
- Microsoft Windows NT 4.0
Trend Micro OfficeScan Corporate Edition 6.5
Trend Micro OfficeScan Corporate Edition 5.58
Trend Micro OfficeScan Corporate Edition 5.5
Trend Micro OfficeScan Corporate Edition 5.0 2
Trend Micro OfficeScan Corporate Edition 3.54
- Microsoft Windows 2000 Professional SP2
- Microsoft Windows 2000 Professional SP1
- Microsoft Windows 2000 Professional
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows 98SE
- Microsoft Windows ME
- Microsoft Windows NT 4.0 SP6a
- Microsoft Windows NT 4.0 SP5
- Microsoft Windows NT 4.0 SP4
- Microsoft Windows NT 4.0 SP3
- Novell Netware 5.1
- Novell Netware 5.0
- Novell Netware 4.11
- Novell Netware 4.1
- Novell Netware 3.1.2
Trend Micro OfficeScan Corporate Edition 3.13
- Microsoft Windows 3.1
- Microsoft Windows 2000 Professional
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows NT 4.0
- Novell Netware 4.11
- Novell Netware 4.1
Trend Micro OfficeScan Corporate Edition 3.11
- Microsoft Windows 3.1
- Microsoft Windows 2000 Professional
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows NT 4.0
- Novell Netware 4.11
- Novell Netware 4.1
Trend Micro OfficeScan Corporate Edition 3.5
- Microsoft Windows 3.1
- Microsoft Windows 2000 Professional
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows NT 4.0
- Novell Netware 4.11
- Novell Netware 4.1
Trend Micro OfficeScan Corporate Edition 3.0
- Microsoft Windows 3.1
- Microsoft Windows 2000 Professional
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows NT 4.0
- Novell Netware 4.11
- Novell Netware 4.1
Trend Micro InterScan WebProtect for ISA
Trend Micro InterScan WebManager 2.1
Trend Micro InterScan WebManager 2.0
Trend Micro InterScan WebManager 1.2
- Microsoft Windows 2000 Professional SP2
- Microsoft Windows 2000 Professional SP1
- Microsoft Windows 2000 Professional
- Microsoft Windows NT 4.0 SP6a
- Microsoft Windows NT 4.0 SP6
- Microsoft Windows NT 4.0 SP5
- Microsoft Windows NT 4.0 SP4
- Microsoft Windows NT 4.0 SP3
- Microsoft Windows NT 4.0 SP2
- Microsoft Windows NT 4.0 SP1
- Microsoft Windows NT Server 4.0
Trend Micro InterScan WebManager 1.2
Trend Micro InterScan Web Security Suite for Windows
Trend Micro InterScan Web Security Suite for Solaris
Trend Micro InterScan Web Security Suite for Linux
Trend Micro InterScan VirusWall for Windows NT 5.1
Trend Micro InterScan VirusWall for Windows NT 3.52 build 1466
Trend Micro InterScan VirusWall for Windows NT 3.52
- Microsoft Windows NT Enterprise Server 4.0 SP6a
- Microsoft Windows NT Enterprise Server 4.0 SP6
- Microsoft Windows NT Enterprise Server 4.0 SP5
- Microsoft Windows NT Enterprise Server 4.0 SP4
- Microsoft Windows NT Enterprise Server 4.0 SP3
- Microsoft Windows NT Enterprise Server 4.0 SP2
- Microsoft Windows NT Enterprise Server 4.0 SP1
- Microsoft Windows NT Enterprise Server 4.0
- Microsoft Windows NT Server 4.0 SP6a
- Microsoft Windows NT Server 4.0 SP6
- Microsoft Windows NT Server 4.0 SP5
- Microsoft Windows NT Server 4.0 SP4
- Microsoft Windows NT Server 4.0 SP3
- Microsoft Windows NT Server 4.0 SP2
- Microsoft Windows NT Server 4.0 SP1
- Microsoft Windows NT Server 4.0
- Microsoft Windows NT Terminal Server 4.0 SP6
- Microsoft Windows NT Terminal Server 4.0 SP5
- Microsoft Windows NT Terminal Server 4.0 SP4
- Microsoft Windows NT Terminal Server 4.0 SP3
- Microsoft Windows NT Terminal Server 4.0 SP2
- Microsoft Windows NT Terminal Server 4.0 SP1
- Microsoft Windows NT Terminal Server 4.0 alpha
- Microsoft Windows NT Terminal Server 4.0
- Microsoft Windows NT Workstation 4.0 SP6a
- Microsoft Windows NT Workstation 4.0 SP6
- Microsoft Windows NT Workstation 4.0 SP5
- Microsoft Windows NT Workstation 4.0 SP4
- Microsoft Windows NT Workstation 4.0 SP3
- Microsoft Windows NT Workstation 4.0 SP2
- Microsoft Windows NT Workstation 4.0 SP1
- Microsoft Windows NT Workstation 4.0
Trend Micro InterScan VirusWall for Windows NT 3.51
- Microsoft Windows NT 3.5.1 SP5
- Microsoft Windows NT 3.5.1 SP4
- Microsoft Windows NT 3.5.1 SP3
- Microsoft Windows NT 3.5.1 SP2
- Microsoft Windows NT 3.5.1 SP1
- Microsoft Windows NT 3.5.1
- Microsoft Windows NT 4.0 SP6a
- Microsoft Windows NT 4.0 SP6
- Microsoft Windows NT 4.0 SP5
- Microsoft Windows NT 4.0 SP4
- Microsoft Windows NT 4.0 SP3
- Microsoft Windows NT 4.0 SP2
- Microsoft Windows NT 4.0 SP1
- Microsoft Windows NT 4.0
- Microsoft Windows NT 3.5
Trend Micro InterScan VirusWall for Windows NT 3.6
Trend Micro InterScan VirusWall for Windows NT 3.5
- Microsoft Windows NT 3.5.1 SP5
- Microsoft Windows NT 3.5.1 SP4
- Microsoft Windows NT 3.5.1 SP3
- Microsoft Windows NT 3.5.1 SP2
- Microsoft Windows NT 3.5.1 SP1
- Microsoft Windows NT 3.5
Trend Micro InterScan VirusWall for Windows NT 3.4
- Microsoft Windows NT 4.0
Trend Micro InterScan VirusWall for Windows
Trend Micro InterScan VirusWall for Unix 3.6 x
Trend Micro InterScan VirusWall for Unix 3.0.1
Trend Micro InterScan VirusWall for SMB Windows NT
Trend Micro InterScan VirusWall for SMB Linux
Trend Micro InterScan VirusWall for SMB
Trend Micro InterScan VirusWall for AIX
Trend Micro Interscan Viruswall (Solaris) 3.6
Trend Micro Interscan Viruswall (Linux) 3.6
- RedHat Linux 6.2 i386
- RedHat Linux 6.1 i386
- S.u.S.E. Linux 7.0
- S.u.S.E. Linux 6.4
- Turbolinux Turbolinux 6.1
Trend Micro Interscan Viruswall (Linux) 3.0.1
- RedHat Linux 6.2 i386
- RedHat Linux 6.1 i386
- S.u.S.E. Linux 7.0
- S.u.S.E. Linux 6.4
- Turbolinux Turbolinux 6.1
Trend Micro Interscan Viruswall (HP-UX) 3.6
Trend Micro InterScan Messaging Security Suite for Windows
Trend Micro InterScan Messaging Security Suite for Solaris
Trend Micro InterScan Messaging Security Suite for Linux
Trend Micro InterScan Messaging Security Suite 5.5
Trend Micro InterScan Messaging Security Suite 3.81
Trend Micro InterScan eManager 3.51 j
- Trend Micro InterScan VirusWall 3.32
- Trend Micro InterScan VirusWall 3.3
- Trend Micro InterScan VirusWall 3.2.3
- Trend Micro InterScan VirusWall 3.0.1
- Trend Micro InterScan VirusWall for Windows NT 3.51
- Trend Micro InterScan VirusWall for Windows NT 3.5
- Trend Micro InterScan VirusWall for Windows NT 3.4
Trend Micro InterScan eManager 3.51
- Trend Micro InterScan VirusWall 3.32
- Trend Micro InterScan VirusWall 3.3
- Trend Micro InterScan VirusWall 3.2.3
- Trend Micro InterScan VirusWall 3.0.1
- Trend Micro InterScan VirusWall for Windows NT 3.51
- Trend Micro InterScan VirusWall for Windows NT 3.5
- Trend Micro InterScan VirusWall for Windows NT 3.4
Trend Micro InterScan eManager 3.6 For Sun
- Sun Solaris 2.6_sparc
Trend Micro InterScan eManager 3.6 For Linux
- Red Hat Linux 6.2
- RedHat Linux 6.1
- S.u.S.E. Linux 7.0
- S.u.S.E. Linux 6.4
- Turbolinux Turbolinux 6.1
Trend Micro InterScan eManager 3.5.2 For Windows
- Microsoft Windows 2000 Advanced Server SP2
- Microsoft Windows 2000 Advanced Server SP1
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Datacenter Server SP2
- Microsoft Windows 2000 Datacenter Server SP1
- Microsoft Windows 2000 Datacenter Server
- Microsoft Windows 2000 Professional SP2
- Microsoft Windows 2000 Professional SP1
- Microsoft Windows 2000 Professional
- Microsoft Windows 2000 Server SP2
- Microsoft Windows 2000 Server SP1
- Microsoft Windows 2000 Server
- Microsoft Windows NT Enterprise Server 4.0 SP6a
- Microsoft Windows NT Enterprise Server 4.0 SP6
- Microsoft Windows NT Enterprise Server 4.0 SP5
- Microsoft Windows NT Enterprise Server 4.0 SP4
- Microsoft Windows NT Enterprise Server 4.0 SP3
- Microsoft Windows NT Server 4.0 SP6a
- Microsoft Windows NT Server 4.0 SP6
- Microsoft Windows NT Server 4.0 SP5
- Microsoft Windows NT Server 4.0 SP4
- Microsoft Windows NT Server 4.0 SP3
- Microsoft Windows NT Workstation 4.0 SP6a
- Microsoft Windows NT Workstation 4.0 SP6
- Microsoft Windows NT Workstation 4.0 SP5
- Microsoft Windows NT Workstation 4.0 SP4
- Microsoft Windows NT Workstation 4.0 SP3
Trend Micro InterScan eManager 3.5 For HP
- HP HP-UX 11.0
- HP HP-UX 10.20
Trend Micro Control Manager Windows
Trend Micro Control Manager Win NT/2000
Trend Micro Control Manager Solaris
Trend Micro Control Manager S/390
Trend Micro Control Manager NetWare
Trend Micro Control Manager AS/400
Trend Micro Client/Server/Messaging Suite for SMB for Windows
Trend Micro Client/Server Suite for SMB for Windows

- 漏洞讨论

The Trend Micro VSAPI scan engine library is prone to a heap-based buffer overflow vulnerability. This vulnerability may be triggered when the library processes a malformed ARJ archive.

The vulnerability affects multiple Trend Micro products. It is also noted that multiple attack vectors exist, as affected software may scan ARJ files in email attachments, and through various file transfer protocols.

- 漏洞利用

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com <mailto:vuldb@securityfocus.com>.

- 解决方案

Upgrading to scan engine VSAPI 7.510 or higher will address this vulnerability. Engine upgrades can be obtained at http://www.trendmicro.com/download/engine.asp

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站