SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Security)  >   Trend Micro OfficeScan Vendors:   Trend Micro
TrendMicro OfficeScan 'winhlp32.exe' Lets Local Users Execute Arbitrary Applications With Local SYSTEM Privileges
SecurityTracker Alert ID:  1010446
SecurityTracker URL:  http://securitytracker.com/id/1010446
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Jun 9 2004
Impact:   Execution of arbitrary code via local system, Root access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 5.5, possibly others
Description:   A vulnerability was reported in TrendMicro's OfficeScan. A local user can gain elevated privileges.

Donald Reid reported that when the software detects a virus, a window owned by the 'OfficeScanNT RealTime Scan' service (ntrtscan.exe) is opened to provide information about the discovered virus. A local user can click on the help button from this window to start 'winhlp32.exe' with the privileges of 'ntrtscan.exe' (local SYSTEM privileges by default). Then, the local user can execute an arbitrary application from the 'File, Open' help window. The specified application will run with the privleges of 'ntrtscan.exe', the report said.

The following steps have been provided to test the vulnerability [quoted]:

- Use the eicar test virus to display the OfficeScan Client Window
- Click the help button
- Start task manager and make sure that the "User name" Column is visible.
- find the "winhlp32.exe" process in the list
- check the user name for winhlp32.exe

If the system is vulnerable, 'winhlp32.exe' will be running with the same account as the OfficeScanNT RealTime Scan service, the report said.

The vendor was reportedly notified on May 10, 2004.

Impact:   A local user can execute arbitrary applications with the privileges of 'ntrtscan.exe' (local SYSTEM privileges by default).
Solution:   The vendor has released a hot fix (OSCE 5.58 Hot Fix - Build 1089), available at:

http://uk.trendmicro-europe.com/enterprise/support/knowledge_base_detail.php?solutionId=20118

Vendor URL:  www.trendmicro.com/ (Links to External Site)
Cause:   Access control error
Underlying OS:  Windows (Any)
Underlying OS Comments:  Tested on Windows XP

Message History:   None.


 Source Message Contents

Subject:  Trend Officescan local privilege escalation


Product:              Trend OfficeScan
Product Description:  Trend OfficeScan is a Corporate Antivirus product from 
Trend Microsystems
Versions affected:    Tested on 5.5 (others may be vulnerable)
Vulnerability type:   Local privilege escalation
Vendor URL:           http://www.trendmicro.com
OS tested             Windows XP + SP1 (others may be vulnerable)
Vendor notified:      10th May 2004
Initial response:     11th May 2004
Patch available:      2nd June 2004
Patch:                
http://uk.trendmicro-europe.com/enterprise/support/knowledge_base_detail.php?solutionId=20118

Details:
When Trend OfficeScan detects a virus, the "OfficeScan Client" window is 
displayed with information regarding the virus found. This Window is owned 
by the "OfficeScanNT RealTime Scan" service (ntrtscan.exe). Clicking the 
help button on this OfficeScan Client window starts winhlp32.exe using the 
same account as the OfficeScan service. This sevice is started with local 
SYSTEM account by default.

>From the winhlp32 file+open explorer window it is simple to start any 
application with the inherited rights of the Officescan service account.

To test the vulnerability:

- Use the eicar test virus[1] to display the OfficeScan Client Window
- Click the help button
- Start task manager and make sure that the "User name" Column is visible.
- find the "winhlp32.exe" process in the list
- check the user name for winhlp32.exe

If the computer is vulnerable the winhlp32.exe will be running with the same 
account as the OfficeScanNT RealTime Scan service.

[1] http://www.eicar.org/anti_virus_test_file.htm

Regards, Donald Reid

donald_reid[at]hotmail.com

_________________________________________________________________
It's fast, it's easy and it's free. Get MSN Messenger today! 
http://www.msn.co.uk/messenger

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC