OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: TrendMicro OfficeScan tmlisten.exe DoS
From: Jeff Stevens (JStevensUMEME.MAINE.EDU)
Date: Fri Feb 25 2000 - 16:10:17 CST

While playing around with nmap I managed to pull down a bunch of our NT
workstations running OfficeScan. This could potentially be used as a DoS
attack to bring down any NT machine running OfficeScan. I used the
following command where machine.domain.com is a Windows NT machine running
either SP 4 or 5 or a Win2k RC3 box.

nmap -sT -O -p 12345 machine.domain.com

One of three things can happen:

        (1) Nothing -- rare but it does happen.
        (2) The machine slows to a halt as tmlisten.exe pulls 100% CPU.
        (3) Visual C++ error as tmlisten.exe crashes.

OfficeScan 3.5, scan engine 5.100 and pattern file 663 are running on the
target machine. (all current)

I can also make the process dump with a Visual C++ error if I send a bunch
of data via telnet.

Upon contacting Trend via phone, they said they were aware of a similar
problem with earlier versions but version 3.5 has been fixed. They are
looking into it.

Curious if anyone else can recreate this? Or give me a set of addresses and
I'll see if I can! :^)

Jeff Stevens
Network Administrator
Civil/Mechanical Engineering
5711 Boardman Hall, Room 17
Orono, ME 04469
(207) 581-2140