Trend Micro OfficeScan tmlisten denial of service
| trendmicro-tmlisten-dos (4039) |  Low Risk |
Description:
Trend Micro OfficeScan is vulnerable to a denial of service attack. OfficeScan is antivirus software for corporate networks. When configured in the Web-based mode on a Windows NT server, the client program tmlisten.exe listens to port 12345 to receive updates and administrative commands. By sending random data to port 12345, an attacker can cause tmlisten.exe to consume 100% of CPU usage, slowing the system to a halt. In some instances, an attacker can cause a Visual C++ error, crashing the tmlisten.exe program.
Platforms Affected:
- Trend Micro, OfficeScan 3.5
Remedy:
Apply the OfficeScan patch appropriate for your system, available from the Trend Micro Updates/Patches Web site. See References.
Consequences:
Denial of Service
References:
- BugTraq Mailing List, Fri Feb 25 2000 - 16:10:17 CST, TrendMicro OfficeScan tmlisten.exe DoS at http://archives.neohapsis.com/archives/bugtraq/2000-02/0349.html.
- BugTraq Mailing List, Thu Mar 16 2000 - 16:46:55 CST, Trend Micro release patch for "OfficeScan DoS & Message Replay" Vulnerabilies at http://archives.neohapsis.com/archives/bugtraq/2000-03/0156.html.
- Trend Micro Updates/Patches, OfficeScan 3.5 Security Bulletin at http://www.antivirus.com/download/ofce_patch_35.htm.
- Trend Micro Updates/Patches, Upgrading from OfficeScan 3.13 or 3.5 to 3.51 at http://www.antivirus.com/download/ofce_patch.htm.
- BID-1013: Trend Micro OfficeScan DoS Vulnerabilities
- CVE-2000-0203: The Trend Micro OfficeScan client tmlisten.exe allows remote attackers to cause a denial of service via malformed data to port 12345.
Reported:
Feb 26, 2000
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net