In association with heise online

08 May 2007, 11:37

Trend Micro's ServerProtect executes injected code

  • Twitter
  • Facebook
  • submit to slashdot
  • StumbleUpon
  • submit to reddit

Trend Micro's ServerProtect anti-virus solution contains vulnerabilities which can be exploited by attackers to execute their own code on affected systems. The Zero Day Initiative has reported bugs in two components of the software which listen for incoming connections and are therefore remotely exploitable.

The current version of ServerProtect, version 5.58, is affected. Trend Micro has made updates available to fix the security vulnerabilities. Administrators of ServerProtect installations should install these as soon as possible.

Non-authenticated attackers can provoke a buffer overflow in the EarthAgent.exe component, which listens on port 3628 using Remote Procedure Call (RPC). A comparable bug is present in the SpntSvc.exe service, which is by default accessible from the outside world via port 5168.

See also:


Print Version | Send by email | Permalink:

  • July's Community Calendar

The H Open

The H Security

The H Developer

The H Internet Toolkit