CVE-2008-3865

Published: Jan 21, 2009Modified: Apr 23, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Multiple heap-based buffer overflows in the ApiThread function in the firewall service (aka TmPfw.exe) in Trend Micro Network Security Component (NSC) modules, as used in Trend Micro OfficeScan 8.0 SP1 Patch 1 and Internet Security 2007 and 2008 17.0.1224, allow remote attackers to execute arbitrary code via a packet with a small value in an unspecified size field.

Affected (3)

Products: Trend Micro: Internet Security 2007, Internet Security 2008, Officescan

3 products

Internet Security 2007

Internet Security 2008

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Trend Micro Internet Security 2007	All versions
Trend Micro Internet Security 2008	Version 17.0.1224
Trend Micro Officescan	Version 8.0 sp1

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (22)

http://secunia.com/advisories/31160

Source: PSIRT-CNA@flexerasoftware.com

Vendor Advisory

http://secunia.com/advisories/33609

Source: PSIRT-CNA@flexerasoftware.com

Vendor Advisory

http://secunia.com/secunia_research/2008-42/

Source: PSIRT-CNA@flexerasoftware.com

Vendor Advisory

http://securityreason.com/securityalert/4937

Source: PSIRT-CNA@flexerasoftware.com

http://www.securityfocus.com/archive/1/500195/100/0/threaded

Source: PSIRT-CNA@flexerasoftware.com

http://www.securityfocus.com/bid/33358

Source: PSIRT-CNA@flexerasoftware.com

Patch

http://www.securitytracker.com/id?1021614

Source: PSIRT-CNA@flexerasoftware.com

http://www.securitytracker.com/id?1021615

Source: PSIRT-CNA@flexerasoftware.com

http://www.trendmicro.com/ftp/documentation/readme/OSCE8.0_SP1_Patch1_CriticalPatch_3191_Readme.txt

Source: PSIRT-CNA@flexerasoftware.com

Vendor Advisory

http://www.vupen.com/english/advisories/2009/0191

Source: PSIRT-CNA@flexerasoftware.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/48107

Source: PSIRT-CNA@flexerasoftware.com

http://secunia.com/advisories/31160

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/33609

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/secunia_research/2008-42/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://securityreason.com/securityalert/4937

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/500195/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/33358

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.securitytracker.com/id?1021614

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1021615

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.trendmicro.com/ftp/documentation/readme/OSCE8.0_SP1_Patch1_CriticalPatch_3191_Readme.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.vupen.com/english/advisories/2009/0191

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/48107

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.