Trend Micro OfficeScan 7.3 patch 4 build 1362描述:
BUGTRAQ ID: 31139
CVE(CAN) ID: CVE-2008-2437
OfficeScan是一种针对整个网段的分布式杀毒软件。
OfficeScan的cgiRecvFile.exe中存在栈溢出漏洞,如果远程攻击者在提交的HTTP请求中包含了超长的ComputerName参数的话,就可以触发这个溢出,导致执行任意指令。必须还要控制TempFileName、NewFileSize和Verify参数才能利用这个漏洞。
<*来源:Dyon Balding
链接:http://secunia.com/secunia_research/2008-35/
*>
建议:
厂商补丁:
Trend Micro
-----------
目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:
http://www.trendmicro.com/ftp/products/patches/OSCE_8.0_SP1_Patch1_Win_EN_CriticalPatch_B3060.exe
http://www.trendmicro.com/ftp/products/patches/OSCE_8.0_SP1_Win_EN_CriticalPatch_B2424.exe
http://www.trendmicro.com/ftp/products/patches/OSCE_8.0_Win_EN_CriticalPatch_B1361.exe
http://www.trendmicro.com/ftp/products/patches/CSM_3.6_OSCE_7.6_Win_EN_CriticalPatch_B1195.exe
http://www.trendmicro.com/ftp/products/patches/OSCE_7.3_Win_EN_CriticalPatch_B1367.exe
