Secunia

ISS X-Force has reported a vulnerability in various Trend Micro products, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to a boundary error in the AntiVirus library when processing ARJ files. This can be exploited to cause a heap-based buffer overflow via a specially crafted ARJ file containing an overly long filename.

Successful exploitation allows execution of arbitrary code.

The vulnerability affects the following products:
* Trend Micro Client / Server / Messaging Suite for SMB for Windows
* Trend Micro Client / Server Suite for SMB for Windows
* Trend Micro InterScan eManager
* Trend Micro InterScan Messaging Security Suite for Linux
* Trend Micro InterScan Messaging Security Suite for Solaris
* Trend Micro InterScan Messaging Security Suite for Windows
* Trend Micro InterScan VirusWall for AIX
* Trend Micro InterScan VirusWall for HP-UX
* Trend Micro InterScan VirusWall for Linux
* Trend Micro InterScan VirusWall for SMB
* Trend Micro InterScan VirusWall for Solaris
* Trend Micro InterScan VirusWall for Windows
* Trend Micro InterScan Web Security Suite for Linux
* Trend Micro InterScan Web Security Suite for Solaris
* Trend Micro InterScan Web Security Suite for Windows
* Trend Micro InterScan WebManager
* Trend Micro InterScan WebProtect for ISA
* Trend Micro OfficeScan Corp. Edition
* Trend Micro PC-cillin Internet Security
* Trend Micro PortalProtect for SharePoint
* Trend Micro ScanMail eManager
* Trend Micro ScanMail for Lotus Domino on AIX
* Trend Micro ScanMail for Lotus Domino on AS/400
* Trend Micro ScanMail for Lotus Domino on S/390
* Trend Micro ScanMail for Lotus Domino on Solaris
* Trend Micro ScanMail for Lotus Domino on Windows
* Trend Micro ScanMail for Microsoft Exchange
* Trend Micro ServerProtect for Linux
* Trend Micro ServerProtect for Windows

Solution
Update scan engine to VSAPI 7.510 or later.
Further details available in Customer Area

Provided and/or discovered by
Alex Wheeler, ISS X-Force.

Changelog
Further details available in Customer Area

Original Advisory
Trend Micro:
http://www.trendmicro.com/vinfo/secadvisories/default6.asp?VName=Vulnerability+in+VSAPI+ARJ+parsing+could+allow+Remote+Code+execution

ISS X-Force:
http://xforce.iss.net/xforce/alerts/id/189

Deep Links
Links available in Customer Area