Security experts believe increased scanning of a TCP port, related to Trend Micro's anti-virus solution, is not the result of two product vulnerabilities announced this week but instead an older flaw that already has been patched.Handlers with the SANS Internet Storm Center reported today that they were witnessing increased activity on port 5168, likely the work of overseas hackers searching for Windows servers vulnerable to a bug announced February in Trend's ServerProtect anti-virus product.
This confused some researchers, who initially assumed the scans were related to two other buffer overflow vulnerabilities in ServerProtect, revealed on Wednesday by iDefense. Trend has issued patches for those flaws.
"Indications are that the ServerProtect exploit is against an older vulnerability from earlier this year," SANS handler Kyle Haugsness wrote today on the organisation’s blog. "But this does indeed appear to be a new exploit, thus machines are being actively compromised if they haven’t been patched."
Jose Nazario, senior security researcher at Arbor Networks, wrote on his blog today that the scans are mostly being conducted by Chinese-based botnets.
Customers have not reported any problems, Trend spokesman Mike Haro said.
"It's speculative whether an increasein 5168 traffic is indicative that these hackers are successful in compromising networks," he said. "We've received no reports from ServerProtect customers of them having problems, of them having been compromised."