Welcome to RCF - WHF

rb2d2 · Sep 25, 2004

Trend Micro is warning of a serious security flaw in several of its products that could cause a vulnerable PC to crash or be hijacked.

The flaw in its antivirus scan engine could be used to trigger a buffer overflow using a corrupted UPX file, the software maker said in an advisory issued earlier this week. For example, an outsider could send an e-mail with the malicious file to a computer loaded with the affected antivirus software.

As a result, the PC could suffer a "blue screen of death" or allow the attacker to remotely execute code and take control of the system, Trend Micro said.

Security companies such as Secunia have rated the flaw as "highly critical." There are no exploits for the vulnerability circulating yet, Trend Micro said.

The flaw affects all of Trend Micro's products that use its scan engine and pattern file technology, including its PC-cillin line and certain versions of Client Server Messaging Security for SMB. The at-risk software makes up a wide swath of its product line.

Experts have said that antivirus software is becoming more attractive as a target for hackers. In January, Symantec acknowledged that a known hole in its corporate antivirus tool was coming under persistent attack from worms.

Shocked