PT-2007-5411 · Trend Micro · Trend Micro Serverprotect For Windows+1

Jun Mao · Published 2007-08-22 · Updated 2018-10-15 · CVE-2007-4218

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Trend Micro ServerProtect for Windows versions prior to 5.58 Security Patch 4

Description The issue concerns multiple buffer overflows in the ServerProtect service, allowing remote attackers to execute arbitrary code via certain RPC requests to specific TCP ports. These requests are processed by various functions, including RPCFN ENG NewManualScan, RPCFN ENG TimedNewManualScan, RPCFN SetComputerName, RPCFN CMON SetSvcImpersonateUser, RPCFN OldCMON SetSvcImpersonateUser, RPCFN ENG TakeActionOnAFile, RPCFN ENG AddTaskExportLogItem, NTF SetPagerNotifyConfig, and RPCFN CopyAUSrc, which are located in different DLL files such as StRpcSrv.dll, Stcommon.dll, Eng50.dll, Notification.dll.

Recommendations For Trend Micro ServerProtect for Windows versions prior to 5.58 Security Patch 4, apply Security Patch 4 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable TCP ports and disabling the RPCFN ENG NewManualScan, RPCFN ENG TimedNewManualScan, RPCFN SetComputerName, RPCFN CMON SetSvcImpersonateUser, RPCFN OldCMON SetSvcImpersonateUser, RPCFN ENG TakeActionOnAFile, RPCFN ENG AddTaskExportLogItem, NTF SetPagerNotifyConfig, and RPCFN CopyAUSrc functions until the patch is applied.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-20

CWE-119

CWE-189

Related Identifiers

CVE-2007-4218

Affected Products

Trend Micro Serverprotect For Windows

Trend Micro Serverprotect

References · 20

• https://nvd.nist.gov/vuln/detail/CVE-2007-4218 · Security Note
• http://securityfocus.com/bid/25395 · Patch
• http://vupen.com/english/advisories/2007/2934 · Vendor Advisory
• http://secunia.com/advisories/26523 · Vendor Advisory
• http://trendmicro.com/ftp/documentation/readme/spnt_558_win_en_securitypatch4_readme.txt · Note
• http://frsirt.com/english/advisories/2007/2934 · Note
• http://us-cert.gov/cas/techalerts/TA07-235A.html · Note
• http://securitytracker.com/id?1018594 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36178 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36176 · Note
• http://securityfocus.com/archive/1/478866/100/0/threaded · Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=587 · Note
• http://zerodayinitiative.com/advisories/ZDI-07-050.html · Note
• http://kb.cert.org/vuls/id/109056 · Note
• http://securityreason.com/securityalert/3052 · Note