----------------------------------------------------------------------

Did you know that a change in our assessment rating, exploit code
availability, or if an updated patch is released by the vendor, is
not part of this mailing-list?

Click here to learn more:
http://secunia.com/advisories/business_solutions/

----------------------------------------------------------------------

TITLE:
Trend Micro Internet Security Firewall Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA31160

VERIFY ADVISORY:
http://secunia.com/advisories/31160/

CRITICAL:
Less critical

IMPACT:
Security Bypass, Privilege escalation, DoS

WHERE:
Local system

SOFTWARE:
Trend Micro Internet Security Pro 2008
http://secunia.com/advisories/product/16915/
Trend Micro Internet Security 2008
http://secunia.com/advisories/product/16916/
Trend Micro PC-cillin Internet Security 2007
http://secunia.com/advisories/product/13436/

DESCRIPTION:
Secunia Research has discovered some vulnerabilities in Trend Micro
Internet Security, which can be exploited by malicious, local users
to cause a DoS (Denial of Service), bypass certain security features,
and potentially gain escalated privileges.

1) Input validation errors exist in the Trend Micro Personal Firewall
service (TmPfw.exe) within the "ApiThread()" function when processing
packets sent to the service (by default port 40000/TCP). These can be
exploited to crash the service via specially crafted packets
containing an overly large value in a size field.

2) Input validation errors exist in the Trend Micro Personal Firewall
service (TmPfw.exe) within the "ApiThread()" function when processing
packets sent to the service (by default port 40000/TCP). These can be
exploited to cause heap-based buffer overflows via specially crafted
packets containing a small value in a size field.

Successful exploitation may allow execution of arbitrary code with
SYSTEM privileges.

3) Missing authentication to the Trend Micro Personal Firewall
service (TmPfw.exe) listening on port 40000/TCP by default can be
exploited by any local user to manipulate the firewall configuration
via specially crafted packets regardless of whether password
restriction has been enabled for the configuration interface.

The vulnerabilities are confirmed in versions 16.10.1063 and
16.10.1079. Other versions may also be affected.

SOLUTION:
The vendor is currently working on a fix, which should be available
shortly.

PROVIDED AND/OR DISCOVERED BY:
Carsten Eiram, Secunia Research.

ORIGINAL ADVISORY:
Secunia Research:
http://secunia.com/secunia_research/2008-42/
http://secunia.com/secunia_research/2008-43/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------