Pedram Amini

Name of the Vulnerable Software and Affected Versions: Trend Micro ServerProtect for Windows versions 5.58 EMC versions 5.58 Network Appliance Filer versions 5.61 through 5.62 Description: The issue allows remote attackers to execute arbitrary code via crafted RPC requests to TmRpcSrv.dll, triggering overflows when calling specific functions. The affected functions include (1) CMON NetTestConnection, (2) CMON ActiveUpdate, and (3) CMON ActiveRollback in StCommon.dll, as well as (4) ENG SetRealTimeScanConfigInfo and (5) ENG SendEMail in eng50.dll. Recommendations: For Trend Micro ServerProtect for Windows version 5.58, consider disabling the CMON NetTestConnection, CMON ActiveUpdate, and CMON ActiveRollback functions in StCommon.dll, and the ENG SetRealTimeScanConfigInfo and ENG SendEMail functions in eng50.dll until a patch is available. For EMC version 5.58, consider disabling the CMON NetTestConnection, CMON ActiveUpdate, and CMON ActiveRollback functions in StCommon.dll, and the ENG SetRealTimeScanConfigInfo and ENG SendEMail functions in eng50.dll until a patch is available. For Network Appliance Filer versions 5.61 through 5.62, consider disabling the CMON NetTestConnection, CMON ActiveUpdate, and CMON ActiveRollback functions in StCommon.dll, and the ENG SetRealTimeScanConfigInfo and ENG SendEMail functions in eng50.dll until a patch is available.

Name of the Vulnerable Software and Affected Versions: HP OpenView Client Configuration Manager (CCM) (affected versions not specified) Description: The issue allows remote attackers to cause a denial of service, such as a reboot, by calling `radbootw.exe` or create arbitrary files by calling `radcrecv.exe` due to the lack of authentication required by `radexecd.exe` before executing commands in the installation directory. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions prior to Server 2003 SP2 Microsoft Windows 2000 SP4 Microsoft Windows XP SP1 and SP2 **Description** The issue is related to a heap-based buffer overflow in the Server Service, allowing remote attackers to execute arbitrary code. This is achieved by sending crafted first-class Mailslot messages that trigger memory corruption and bypass size restrictions on second-class Mailslot messages. The vulnerability could allow an attacker to take complete control of the affected system. **Recommendations** For Microsoft Windows 2000 SP4, apply the necessary patch to fix the heap-based buffer overflow in the Server Service. For Microsoft Windows XP SP1 and SP2, update to a newer service pack to resolve the issue. For Microsoft Windows Server 2003 up to SP1, apply the necessary patch or update to a newer service pack to fix the vulnerability. As a temporary workaround, consider restricting access to the Server Service to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Microsoft Hyperlink Object Library (hlink.dll) (affected versions not specified) **Description** The issue is related to a stack-based buffer overflow in the HrShellOpenWithMonikerDisplayName function, allowing remote attackers to cause a denial of service and possibly execute arbitrary code via a long hyperlink. This can be exploited by constructing a malicious hyperlink, potentially leading to remote code execution if a user clicks the link within an Office file or email message, giving an attacker complete control of the affected system. User interaction is required to exploit this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trend Micro ServerProtect EarthAgent for Windows Management Console version 5.58 and earlier **Description** The issue allows remote attackers to cause a denial of service due to CPU consumption via a flood of crafted packets with a certain `magic value` to the "port 5005" endpoint, which also leads to a memory leak. **Recommendations** For Trend Micro ServerProtect EarthAgent for Windows Management Console version 5.58 and earlier, consider restricting access to port 5005 as a temporary workaround to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** VERITAS Backup Exec Server versions 9.0 through 10.0 **Description** The issue allows remote unauthenticated attackers to modify the registry by calling methods to the RPC interface on TCP port 6106. **Recommendations** For versions 9.0 through 10.0, consider restricting access to the RPC interface on TCP port 6106 to prevent unauthorized modifications to the registry.

**Name of the Vulnerable Software and Affected Versions** VERITAS Backup Exec Remote Agent versions 9.0 through 10.0 for Windows VERITAS Backup Exec Remote Agent versions 9.0.4019 through 9.1.307 for Netware **Description** A stack-based buffer overflow issue allows remote attackers to execute arbitrary code via a "CONNECT CLIENT AUTH" request with authentication method type 3 (Windows credentials) and a long `password` argument. **Recommendations** For VERITAS Backup Exec Remote Agent versions 9.0 through 10.0 for Windows, update to a version outside of the affected range to resolve the issue. For VERITAS Backup Exec Remote Agent versions 9.0.4019 through 9.1.307 for Netware, update to a version outside of the affected range to resolve the issue.