PC-Cillin 6.x DoS Attack

From: Daniel P. Stasinski (dannysat_private)
Date: Thu Dec 30 1999 - 10:37:09 PST

Next message: Marc Farnum Rendino: "Re: The "Mac DoS Attack," a Scheme for Blocking Internet"

Previous message: Dave Dittrich: "Analysis of "stacheldraht""
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Version 6.x of Trend Micro's PC-Cillin Anti-Virus software can be
subjected to a remote DoS attack and possibly authorized relays.

As part of it's Java/ActiveX protection, it routes all http
requests through its own internal proxy on port 8431.
Unfortunately, it allows anyone anywhere to connect to that port
and dump enough data through it to saturate an unexpected victims
connection.   Their tech's could not confirm or deny if remote
users are able to get an outbound connection from the victims
system.

I have contacted Trend Micro, and they are aware of the problem
but have no plans for a hot patch.  They did say it would be
fixed in the next major release (v7.0 ?)

Daniel
--
| Daniel P. Stasinski     | KareMor International, Inc.
| Software Engineer       | 2401 South 24th Street
| Internet Services Dept. | Phoenix, AZ 85034
| danielsat_private     | http://www.karemor.com

Next message: Marc Farnum Rendino: "Re: The "Mac DoS Attack," a Scheme for Blocking Internet"
Previous message: Dave Dittrich: "Analysis of "stacheldraht""
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:25:04 PDT