Vulnerability

    RegGo.dll

Affected

    TrendMicro InterScan WebManager Version 1.2

Description

    Following is based on a SNS Advisory No.33.  Trend Micro InterScan
    WebManager  is  a  software  which  provides malicious mobile code
    protection,  URL  filtering  and  traffic  management.   A  buffer
    overflow vulnerability exists  in RegGo.dll which  is used as  web
    management console  feature in  InterScan WebManager  version 1.2.
    This problem can allow remote users to execute arbitrary  commands
    with SYSTEM privilege.

    InterScan WebManager has a  feature which provides management  web
    console.  RegGo.dll  which is used  for this feature  has a buffer
    overflow vulnerability when long parameter was given.

    A buffer overflow occurs with the following dump:

        00F0FC6C  42 42 42 42  BBBB
        00F0FC70  43 43 43 43  CCCC
        00F0FC74  44 44 44 44  DDDD
        00F0FC78  45 45 45 45  EEEE

        EAX = 00F0FC6C
        EIP = 41414141

    Therefore,  arbitrary  code  which  is  addressed  00F0FC6C may be
    executed by calling eax.

    This has been discovered by Arai Yuu.

Solution

    No patches are available at this momen.  Trend Micro support  team
    responded that  this problem  would be  fixed on  next version  of
    WebManager.  But  they didn't provide  any further information  in
    detail.  Until  the patch is  released, restrict access  to refuse
    access to servers which WebManager had installed.