Remote exploitation of multiple buffer overflow vulnerabilities in Trend
Micro Inc.'s ServerProtect anti-virus software could allow attackers to
execute arbitrary code with system level privilege.
The Trend ServerProtect service (SpntSvc.exe) handles RPC requests on
TCP port 5168 with interface uuid 25288888-bd5b-11d1-9d53-0080c83a5c2c.
This service utilizes the StRpcSrv.dll, Stcommon.dll, Eng50.dll and
Notification.dll libraries to service various RPC requests.
Three buffer overflows exist with the StRpcSrv.dll library. The first
Remote exploitation of an integer overflow vulnerability in Trend Micro
Inc.'s ServerProtect anti-virus software could allow attackers to
execute arbitrary code with system level privilege.
The Trend ServerProtect service (SpntSvc.exe) handles RPC requests on
TCP port 5168 with interface uuid 25288888-bd5b-11d1-9d53-0080c83a5c2c.
This service utilizes the StRpcSrv.dll library to service various RPC
requests.
An integer overflow exists wtihin the RPCFN_SYNC_TASK function. This
http://labs.idefense.com/intelligence/vulnerabilities/
Oct 25, 2007
I. BACKGROUND
The Trend Micro AntiVirus scan engine provides AntiVirus capabilities to
desktop, server, and gateway systems. The engine is licensed to several
of Trend Micro's OEM partners. More information is available on Trend
Micro's web site at the following URL.
http://www.trendmicro.com/
