PT-2007-3832 · Trend Micro · Spntsvc.Exe+4

Eric Detoisien · Published 2007-05-08 · Updated 2018-10-16 · CVE-2007-2508

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Trend Micro ServerProtect versions 5.58 before Security Patch 2 Build 1174

Description The issue involves multiple stack-based buffer overflows that allow remote attackers to execute arbitrary code via crafted data to specific TCP ports. This is achieved by triggering overflows in the CAgRpcClient::CreateBinding function in the AgRpcCln.dll library in SpntSvc.exe via TCP port 5168, or in EarthAgent.exe via TCP port 3628. Both issues are reachable via TmRpcSrv.dll.

Recommendations For Trend Micro ServerProtect version 5.58 before Security Patch 2 Build 1174, apply Security Patch 2 Build 1174 to resolve the issue. As a temporary workaround, consider restricting access to TCP ports 5168 and 3628 to minimize the risk of exploitation. Avoid using the CAgRpcClient::CreateBinding function in the AgRpcCln.dll library until the issue is resolved. Restrict access to the TmRpcSrv.dll library to minimize the risk of exploitation.

Exploit

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2007-2508

Affected Products

Agrpccln.Dll

Earthagent.Exe

Spntsvc.Exe

Tmrpcsrv.Dll

Trend Micro Serverprotect

References · 28

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/antivirus/trendmicro_serverprotect_earthagent.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/antivirus/trendmicro_serverprotect_createbinding.rb · Exploit
• 🔥 http://securityfocus.com/bid/23866 · Exploit
• 🔥 https://exploit-db.com/exploits/29964 · Exploit
• 🔥 https://exploit-db.com/exploits/16829 · Exploit
• 🔥 https://exploit-db.com/exploits/16828 · Exploit
• http://secunia.com/advisories/25186 · Vendor Advisory
• http://zerodayinitiative.com/advisories/ZDI-07-025.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2508 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-07-024.html · Vendor Advisory
• http://trendmicro.com/ftp/documentation/readme/spnt_558_win_en_securitypatch2_readme.txt · Vendor Advisory
• http://securitytracker.com/id?1018010 · Patch
• http://vupen.com/english/advisories/2007/1689 · Vendor Advisory
• http://osvdb.org/35790 · Note
• http://securityfocus.com/archive/1/archive/1/467933/100/0/threaded · Note