<<<<USE COURIER REGULAR 10 FONT IF YOU WOULD LIKE TO PRINT THIS DOCUMENT>>>>


  Trend Micro, Inc.                                  September  30, 2008

  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                   Trend Micro(TM) OfficeScan(TM) 7.3
               Critical Patch - Build 1372 Client Module
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   NOTICE: This critical patch was developed as a workaround or solution
   to a customer-reported problem. As such, this critical patch has 
   received limited testing and has not been certified as an official 
   product update. Consequently, THIS CRITICAL PATCH IS PROVIDED 
   "AS IS". TREND MICRO MAKES NO WARRANTY OR PROMISE ABOUT THE OPERATION
   OR PERFORMANCE OF THIS CRITICAL PATCH NOR DOES IT WARRANT THAT THIS 
   CRITICAL PATCH IS ERROR FREE. TO THE FULLEST EXTENT PERMITTED BY LAW,
   TREND MICRO DISCLAIMS ALL IMPLIED AND STATUTORY WARRANTIES, INCLUDING
   BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY, 
   NONINFRINGEMENT AND FITNESS FOR A PARTICULAR PURPOSE. 

     
     Contents
     ===================================================================
     1.  Overview of This Critical Patch Release
	  1.1 Files Included in This Release
     2.  What's New
     3.  Documentation Set
     4.  System Requirements
     5.  Installation/Uninstallation
     6.  Post-Installation Configuration
     7.  Known Issues
     8.  Release History
     9.  Contact Information
     10. About Trend Micro
     11. License Agreement
     ===================================================================


1. Overview of This Critical Patch Release
========================================================================
      This critical patch addresses a client directory traversal 
      vulnerability in the OfficeScan Update Agent.

      The OfficeScan Update Agent client can receive requests from other
      clients. For update file distribution, the request format is 
      "/activeupdate/<update file path>".

      When the OfficeScan Update Agent client complies with this 
      request, it can recognize and resolve the update file path 
      but does not verify it. As a result, if an attacker changes
      the path to the directory traversal format, the following occur:
     
      - directory traversal, and
      - disclosure of file contents.

   1.1 Files Included in This Release 
   ======================================================================
       Module File Name	Build 		Number    
       --------------------      	------------------
       Tmlisten.exe              	7.3.0.1372


2. What's New
========================================================================
      A client directory traversal vulnerability in the OfficeScan 
      Update Agent may be exploited to traverse other directories and
      view the contents of files.
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      Critical patch 1372 adds a security check feature to the 
      OfficeScan client to avoid client directory traversal. 

      After applying critical patch 1372, the OfficeScan client:
   
      - Checks the update file path before opening it. It will only allow
        access to files under the "activeupdate" folder.
   
      - Normalizes the update file path before working on any file.
        Normalizing the path converts any relative path characters to
        a correct and complete path.


3. Documentation Set
========================================================================
   o Readme.txt -- basic installation, known issues, release history,
     and contact information 
    
   Electronic versions of the printed manuals are available at:
     http://www.trendmicro.com/download


4. System Requirements
========================================================================
   Install OfficeScan 7.3 Patch 4 before installing this 
   critical patch.


5. Installation/Uninstallation
========================================================================
   5.1 Installation
   =====================================================================
   To install this critical patch:
 
   1. Copy the critical patch executable file to a temporary folder, 
      for example, "C:\temp".

   2. Double-click the file. All critical patch modules are 
      automatically copied to the correct destination.

   This critical patch installation package automatically rolls back 
   the OfficeScan server to its previous configuration if it encounters
   problems during installation.

   If you encounter problems after installation, do a manual rollback.

   5.2 Manual Rollback Procedure
   =====================================================================
   To manually roll back to the original configuration:
  
   1. Locate the backup folder that the critical patch package created 
      in the "\Trend Micro\PCCSRV\Backup\criticalPatch_B1372" directory.

   2. Copy the backup modules to the original folders.
      Copy "Tmlisten.exe" files from the backup location to the 
      following folders:
        
        - PCCSRV\Pccnt\Common
        - PCCSRV\Pccnt\Win64\X64    
      
 
6. Post-Installation Configuration
========================================================================
   No post-installation steps are required.
 
   Note: Trend Micro recommends that you update your scan engine and  
   virus pattern files immediately after installing this product.


7. Known Issues
========================================================================
   There are no known issues for this critical patch release.


8. Release History 
========================================================================
   Visit the following Web site for more information about updates 
   to this product:

   http://www.trendmicro.com/download


9. Contact Information
========================================================================
   A license to the Trend Micro software usually includes the right to 
   product updates, pattern file updates, and basic technical support 
   for one (1) year from the date of purchase only. After the first 
   year, Maintenance must be renewed on an annual basis at Trend Micro's 
   then-current Maintenance fees.

   You can contact Trend Micro via fax, phone, and email, or visit us 
   at:

   http://www.trendmicro.com

   Evaluation copies of Trend Micro products can be downloaded from our 
   Web site.

   Global Mailing Address/Telephone numbers
   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   For global contact information in the Asia/Pacific region, Australia 
   and New Zealand, Europe, Latin America, and Canada, refer to:

   http://www.trendmicro.com/en/about/overview.htm

   The Trend Micro "About Us" screen displays. Click the appropriate 
   link in the "Contact Us" section of the screen.

   Note: This information is subject to change without notice.


10. About Trend Micro
========================================================================
   Trend Micro, Inc. provides virus protection, anti-spam, and 
   content-filtering security products and services. Trend Micro allows 
   companies worldwide to stop viruses and other malicious code from a 
   central point before they can reach the desktop.

   Copyright 2008, Trend Micro Incorporated. All rights reserved.
   Trend Micro, the t-ball logo, and OfficeScan are trademarks of 
   Trend Micro Incorporated and are registered in some jurisdictions. 
   All other marks are the trademarks or registered trademarks of their 
   respective companies.


11. License Agreement
========================================================================
   Information about your license agreement with Trend Micro can be 
   viewed at:

   http://www.trendmicro.com/en/purchase/license/

   Third-party licensing agreements can be viewed:
     - By selecting the "About" option in the application user interface
     - By referring to the "Legal" page of the Getting Started Guide or 
       Administrator's Guide