Product: Trend OfficeScan
Product Description: Trend OfficeScan is a Corporate Antivirus product from
Versions affected: Tested on 5.5 (others may be vulnerable)
Vulnerability type: Local privilege escalation
Vendor URL: http://www.trendmicro.com
OS tested Windows XP + SP1 (others may be vulnerable)
Vendor notified: 10th May 2004
Initial response: 11th May 2004
Patch available: 2nd June 2004
Details: When Trend OfficeScan detects a virus, the "OfficeScan Client" window is displayed with information regarding the virus found. This Window is owned by the "OfficeScanNT RealTime Scan" service (ntrtscan.exe). Clicking the help button on this OfficeScan Client window starts winhlp32.exe using the same account as the OfficeScan service. This sevice is started with local SYSTEM account by default.
>From the winhlp32 file+open explorer window it is simple to start any application with the inherited rights of the Officescan service account.
To test the vulnerability:
If the computer is vulnerable the winhlp32.exe will be running with the same account as the OfficeScanNT RealTime Scan service.
Regards, Donald Reid
It's fast, it's easy and it's free. Get MSN Messenger today! http://www.msn.co.uk/messenger