Design/Logic Flaw

The Trend Micro Personal Firewall service aka TmPfw.exe in Trend Micro Network Security Component NSC modules, as used in Trend Micro OfficeScan 8.0 SP1 Patch 1 and Internet Security 2007 and 2008 17.0.1224, relies on client-side password protection implemented in the configuration GUI, which...

Heap overflow

Multiple heap-based buffer overflows in the ApiThread function in the firewall service aka TmPfw.exe in Trend Micro Network Security Component NSC modules, as used in Trend Micro OfficeScan 8.0 SP1 Patch 1 and Internet Security 2007 and 2008 17.0.1224, allow remote attackers to execute arbitrary...

CVE-2008-3865

Multiple heap-based buffer overflows in the ApiThread function in the firewall service aka TmPfw.exe in Trend Micro Network Security Component NSC modules, as used in Trend Micro OfficeScan 8.0 SP1 Patch 1 and Internet Security 2007 and 2008 17.0.1224, allow remote attackers to execute arbitrary...

CVE-2008-3864

The ApiThread function in the firewall service aka TmPfw.exe in Trend Micro Network Security Component NSC modules, as used in Trend Micro OfficeScan 8.0 SP1 Patch 1 and Internet Security 2007 and 2008 17.0.1224, allows remote attackers to cause a denial of service service crash via a packet with...

CVE-2008-3866

The Trend Micro Personal Firewall service aka TmPfw.exe in Trend Micro Network Security Component NSC modules, as used in Trend Micro OfficeScan 8.0 SP1 Patch 1 and Internet Security 2007 and 2008 17.0.1224, relies on client-side password protection implemented in the configuration GUI, which...

CVE-2008-3865

Multiple heap-based buffer overflows in the ApiThread function in the firewall service aka TmPfw.exe in Trend Micro Network Security Component NSC modules, as used in Trend Micro OfficeScan 8.0 SP1 Patch 1 and Internet Security 2007 and 2008 17.0.1224, allow remote attackers to execute arbitrary...

CVE-2008-3864

The ApiThread function in the firewall service aka TmPfw.exe in Trend Micro Network Security Component NSC modules, as used in Trend Micro OfficeScan 8.0 SP1 Patch 1 and Internet Security 2007 and 2008 17.0.1224, allows remote attackers to cause a denial of service service crash via a packet with...

CVE-2008-3866

The Trend Micro Personal Firewall service aka TmPfw.exe in Trend Micro Network Security Component NSC modules, as used in Trend Micro OfficeScan 8.0 SP1 Patch 1 and Internet Security 2007 and 2008 17.0.1224, relies on client-side password protection implemented in the configuration GUI, which...

CVE-2008-3864

CVE-2008-3864 affects Trend Micro Network Security Component (NSC) firewall modules. The ApiThread() function in the firewall service (TmPfw.exe) processes packets to the default port 40000/TCP and can trigger a heap-based overflow when a size field contains an oversized value, causing a denial o...

CVE-2008-3865

CVE-2008-3865 stems from multiple heap-based buffer overflows in Trend Micro’s Network Security Component (NSC) firewall module, within the ApiThread() function of the firewall service (TmPfw.exe). Affected products include Trend Micro OfficeScan 8.0 SP1 Patch 1 and Trend Micro Internet Security ...

CVE-2008-3866

Affected product : Trend Micro OfficeScan NSC components (TmPfw.exe) used in OfficeScan 8.0 SP1 Patch 1 and Internet Security 2007/2008 (17.0.1224). Vulnerability : The Personal Firewall service relies on client-side password protection in the configuration GUI, but this check is not enforced by ...

CVE-2008-3865: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple heap-based buffer overflows in the ApiThread function in the firewall service aka TmPfw.exe in Trend Micro Network Security Component NSC modules, as used in Trend Micro OfficeScan 8.0 SP1 Patch 1 and Internet Security 2007 and 2008 17.0.1224, allow remote attackers to execute arbitrary...

CVE-2008-3866: Improper Authentication

The Trend Micro Personal Firewall service aka TmPfw.exe in Trend Micro Network Security Component NSC modules, as used in Trend Micro OfficeScan 8.0 SP1 Patch 1 and Internet Security 2007 and 2008 17.0.1224, relies on client-side password protection implemented in the configuration GUI, which...

CVE-2008-3864: Improper Input Validation

The ApiThread function in the firewall service aka TmPfw.exe in Trend Micro Network Security Component NSC modules, as used in Trend Micro OfficeScan 8.0 SP1 Patch 1 and Internet Security 2007 and 2008 17.0.1224, allows remote attackers to cause a denial of service service crash via a packet with...

[Full-disclosure] Secunia Research: Trend Micro Network Security Component Vulnerabilities

====================================================================== Secunia Research 20/01/2009 - Trend Micro Network Security Component Vulnerabilities - ====================================================================== Table of Contents Affected...

[Full-disclosure] Secunia Research: Trend Micro NSC Firewall Configuration Vulnerability

====================================================================== Secunia Research 20/01/2009 - Trend Micro Network Security Component - - Firewall Configuration Vulnerability - ====================================================================== Table of Contents Affected...

Trend Micro OfficeScan / Trend Micro Internet Security multiple security vulnerabilities

Firewall settings manipulations, DoS...

TrendMicro Data Loss Prevention 5.5 Directory Traversal

This module tests whether a directory traversal vulnerability is present in Trend Micro DLP Data Loss Prevention Appliance v5.5 build use auxiliary/admin/http/trendmicro/dlptraversal msf undefineddlptraversal show actions ...actions... msf undefineddlptraversal set ACTION msf undefineddlptraversa...

PT-2009-09: Trend Micro Internet Security Pro 2009 tmactmon.sys Priviliege Escalation Vulnerabilities

Vulnerability Description Positive Technologies Research Team has discovered multiple priviliege escalation vulnerabilities in Trend Micro products. The IOCTL handler in tmactmon.sys uses the METHODNEITHER communication method for IOCTLs and does not properly validate buffer data associated with...

Trend Micro HouseCall ActiveX control does not adequately validate update server parameters

Overview The Trend Micro HouseCall ActiveX control contains a vulnerability that can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description The Trend Micro HouseCall ActiveX control HousecallActiveX.dll includes an update feature. A web page hosting...