CVE-2008-3865: Buffer Overflow

Published Jan 21, 2009

Updated

Multiple heap-based buffer overflows in the ApiThread function in the firewall service (aka TmPfw.exe) in Trend Micro Network Security Component (NSC) modules, as used in Trend Micro OfficeScan 8.0 SP1 Patch 1 and Internet Security 2007 and 2008 17.0.1224, allow remote attackers to execute arbitrary code via a packet with a small value in an unspecified size field.

Affected Software

3 affected components

Trend Micro Internet Security 2007

Trend Micro Internet Security 2008=17.0.1224

Trend Micro OfficeScan=8.0-sp1

Remediation

Patch Available

http://www.securityfocus.com/bid/33358

Event History

Jan 21, 2009

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-3865?

CVE-2008-3865 has a high severity rating due to the potential for remote code execution by attackers.

How do I fix CVE-2008-3865?

To fix CVE-2008-3865, you should apply the latest patches and updates provided by Trend Micro for your affected products.

Which software is affected by CVE-2008-3865?

CVE-2008-3865 affects Trend Micro OfficeScan 8.0 SP1 and Trend Micro Internet Security 2007 and 2008.

What type of vulnerability is CVE-2008-3865?

CVE-2008-3865 is classified as a heap-based buffer overflow vulnerability.

Can CVE-2008-3865 be exploited remotely?

Yes, CVE-2008-3865 can be exploited remotely by attackers.