ARJ File Bug Threatens Trend Micro Scanners

A bug in ARJ file parsing in Trend Micro virus-scanning products could lead to a heap-based buffer overflow and potentially to the execution of attack code in the context of the scanner.

Trend Micro has issued upgrades to version 7.510 of its virus scanning engine (VSAPI).

ARJ is a format for compressed archive files, similar to Zip.

Resource Library:

Software to use it is sold by ARJ Software Inc., although it is supported by many third parties.

According to the Trend advisory, the companys ARJ file format parser reads file names from the ARJ local header into a 512-byte buffer.

But the file names can be oversized, and the Trend engine will copy beyond the end of the buffer.

The next operation after copying the file name to the buffer is to assign data to a variable pointed to by an address just beyond the 512 byte buffer.

Thus, when the file name overflows the buffer, this assignment operation results in an illegal memory access.

Read more here about Britains launch of a Web site aimed at helping computer users avoid damage from online threats.

Its possible that a specially crafted ARJ could execute arbitrary code through this method.

The bug was originally discovered by Internet Security Systems.

Their advisory states that "successful exploitation of this vulnerability could be used to gain unauthorized access to networks and machines being protected by Trend Micro AntiVirus Library product."

Click here to read more about Trend Micro offering a free download and updates for one of the first software products for protecting handheld devices.

This revelation follows a similar one from earlier in February in which a similar vulnerability was found in F-Secures virus-scanning of ARJ files. F-Secure issued a similar advisory and fixes.

Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.