{"vuid":"VU#167739","idnumber":"167739","name":"Trend Micro InterScan eManager vulnerable to remotely exploitable buffer overflow","keywords":["Trend Micro InterScan eManager for NT","buffer overflow","remote execution","arbitrary commands","Local System context"],"overview":"A remotely exploitable buffer overflow exists in Trend Micro InterScan eManager.","clean_desc":"Trend Micro InterScan eManager is an application that inspects email traffic flowing into and out of a network for confidential or inappropriate material entering and/or leaving the network. This application has the capability to inspect, modify, and/or block email at the border of the enterprise. Trend Micro InterScan eManager includes several dynamic link libraries which provide management features for the system administrator over an http interface. Some of these dynamic link libraries contain a remotely exploitable buffer overflow.","impact":"Remote intruders can execute arbitrary code with SYSTEM privileges in the Local System security context.","resolution":"The following versions of InterScan eManager are affected. InterScan eManager for NT Ver.3.51 (English)\nInterScan eManager for NT Ver.3.51(Japanese) These tests were performed on the following Operating Systems: Windows NT 4.0 Server + SP6a [English]\nWindows NT 4.0 Server + SP6a [Japanese] A patch for InterScan eManager for NT Ver.3.51J is available from http://www.trendmicro.co.jp/esolution/solutionDetail.asp?solutionID=3142 \nA patch for InterScan eManager for NT Ver.3.51 is pending.","workarounds":"If console access via the web is not necessary, remove /eManager virtual directory with the use of Internet Service Manager. Enable NTLM authentication using the Internet Service Manager. This will provide restricted access to Web-based console. Restrict access to web-based console with the use of packet filtering technologies.","sysaffected":"","thanks":"This vulnerability was discovered by \nLittle eArth Corporation Co., Ltd\n and was made public on September 12, 2001.","author":"This document was written by Ian A. Finlay.","public":["http://www.trendmicro.co.jp/esolution/solutionDetail.asp?solutionID=3142","http://www.lac.co.jp/security/english/snsadv_e/42_e.html"],"cveids":["CVE-2001-0958"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2001-09-12T15:21:13Z","publicdate":"2001-09-12T00:00:00Z","datefirstpublished":"2001-09-13T17:30:46Z","dateupdated":"2001-09-13T17:33:45Z","revision":52,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"20","cam_exploitation":"0","cam_internetinfrastructure":"10","cam_population":"10","cam_impact":"20","cam_easeofexploitation":"15","cam_attackeraccessrequired":"20","cam_scorecurrent":"33.75","cam_scorecurrentwidelyknown":"33.75","cam_scorecurrentwidelyknownexploited":"56.25","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":33.75,"vulnote":null}