Trend Micro Apex Central Message Unchecked NULL Return Value Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Trend Micro Apex Central. This issue arises from a message processing flaw where a NULL return value is not properly checked, allowing remote attackers to create a denial-of-service condition on affected installations. Notably, authentication is not required to exploit this vulnerability.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing the application to become unresponsive or unavailable.

Reproduction

The vulnerability can be reproduced by sending a message with ID 0x1b5b using the 'new protocol' format. This message should be crafted to omit the expected CRLF termination, causing the application to receive a NULL return value that is not checked. The lack of validation leads to access violations and crashes the application.

Remediation

Users are advised to upgrade to Trend Micro Apex Central Critical Patch Build 7190 or later.