Secunia Research has discovered some vulnerabilities in Trend Micro Internet Security, which can be exploited by malicious, local users to cause a DoS (Denial of Service), bypass certain security features, and potentially gain escalated privileges.

1) Input validation errors exist in the Trend Micro Personal Firewall service (TmPfw.exe) within the "ApiThread()" function when processing packets sent to the service (by default port 40000/TCP). These can be exploited to crash the service via specially crafted packets containing an overly large value in a size field.

2) Input validation errors exist in the Trend Micro Personal Firewall service (TmPfw.exe) within the "ApiThread()" function when processing packets sent to the service (by default port 40000/TCP). These can be exploited to cause heap-based buffer overflows via specially crafted packets containing a small value in a size field.

Successful exploitation may allow execution of arbitrary code with SYSTEM privileges.

3) Missing authentication to the Trend Micro Personal Firewall service (TmPfw.exe) listening on port 40000/TCP by default can be exploited by any local user to manipulate the firewall configuration via specially crafted packets regardless of whether password restriction has been enabled for the configuration interface.

The vulnerabilities are confirmed in versions 16.10.1063 and 16.10.1079. Other versions may also be affected.

Solution
The vendor is currently working on a fix, which should be available shortly.

Provided and/or discovered by
Carsten Eiram, Secunia Research.

Original Advisory
Secunia Research:
http://secunia.com/secunia_research/2008-42/
http://secunia.com/secunia_research/2008-43/

Deep Links
Links available to Secunia VIM customers