eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
A bug in ARJ file parsing in Trend Micro virus-scanning products could lead to a heap-based buffer overflow and potentially to the execution of attack code in the context of the scanner.
Trend Micro has issued upgrades to version 7.510 of its virus scanning engine (VSAPI).
ARJ is a format for compressed archive files, similar to Zip.
Software to use it is sold by ARJ Software Inc., although it is supported by many third parties.
According to the Trend advisory, the companys ARJ file format parser reads file names from the ARJ local header into a 512-byte buffer.
But the file names can be oversized, and the Trend engine will copy beyond the end of the buffer.
The next operation after copying the file name to the buffer is to assign data to a variable pointed to by an address just beyond the 512 byte buffer.
Thus, when the file name overflows the buffer, this assignment operation results in an illegal memory access.
Its possible that a specially crafted ARJ could execute arbitrary code through this method.
The bug was originally discovered by Internet Security Systems.
Their advisory states that “successful exploitation of this vulnerability could be used to gain unauthorized access to networks and machines being protected by Trend Micro AntiVirus Library product.”
This revelation follows a similar one from earlier in February in which a similar vulnerability was found in F-Secures virus-scanning of ARJ files. F-Secure issued a similar advisory and fixes.