The development department at anti-virus vendor Trend Micro has been recently hard at work to plug a hole in the Internet Security 2008 and 2009 products after someone posted a PoC exploit for it.

Trend Micro is one of the largest providers of anti-virus and security solutions in the world. Its flagship product is PC-cillin Internet Security, currently known as Trend Micro Internet Security (TIS). The company also develops HouseCall, one of the first free online anti-virus scanners.

On 30 March 2009, someone going by the handle of "b1@ckeYe" posted a proof-of-concept exploit code for a privilege escalation vulnerability, affecting TIS 2008 and 2009, both standard and professional editions, on the exploit-tracking website milw0rm.

The flaw is located in the 2.52.0.1002 version of the tmactmon.sys (TrendMicro Activity Monitor Module) component and is classified by SecurityFocus as a boundary-condition error. The PoC creator credits research on driver flaws exploitation by Ruben Santamarta.

A day later, on 31 March 2009, Positive Technologies, a Russian security company, released a public advisory about the same vulnerability, which credited an in-house researcher, Nikita Tarakanov, with its discovery.

According to the advisory,  Positive Technologies attempted to report the issue to Trend Micro on February 2nd and February 12th 2009, both times without receiving any response. "The IOCTL handler in tmactmon.sys uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate buffer data associated with the Irp object, which allows local users to gain SYSTEM privilieges," the company explains.

Softpedia has been in contact with Trend Micro since this exploit got published and has been kept informed about the mitigation efforts. Even though most publicly available advisories still describe this vulnerability (CVE-2009-0686) as being unpatched, a Trend Micro representative told us that, "The patch was QAd [quality assured] and released inside 24 hours of the release of the information on milw0rm."

Vulnerabilities being discovered in security software is not too uncommon and Trend Micro is certainly not at its first. Back in December 2008, we wrote about a highly critical vulnerability affecting another of the company's products, HouseCall, which had been disclosed by security research company Secunia. In April 2008, we also reported a denial of service weakness in Bitdefender Antivirus.