Thursday, July 31, 2008 1:13 PM
cmosby
Trend Micro OfficeScan Web-Deployment ObjRemoveCtrl Class Buffer Overflows - Secunia
Trend Micro OfficeScan Web-Deployment ObjRemoveCtrl Class Buffer Overflows
Secunia Advisory:
SA31277
Release Date:
2008-07-29
Critical:
Highly critical
Impact:
System access
Where:
From remote
Solution Status:
Unpatched
Software:
Trend Micro OfficeScan Corporate Edition 7.x
Description:
Elazar Broad has discovered some vulnerabilities in Trend Micro OfficeScan, which can be exploited by malicious people to compromise a user's system.
The vulnerabilities are caused due to boundary errors in the OfficeScan Corp Edition Web-Deployment ObjRemoveCtrl Class ActiveX control (OfficeScanRemoveCtrl.dll) on an OfficeScan client when attempting to display a list of configuration settings. These can be exploited to cause stack-based buffer overflows by passing overly long properties when a user e.g. visits a malicious web site.
Successful exploitation allows execution of arbitrary code, but requires that OfficeScan client was installed using web deployment.
The vulnerabilities are confirmed in version 7.3 build 1343(Patch 4). Other versions may also be affected.
Solution:
Set the kill-bit for the affected ActiveX control.
Provided and/or discovered by:
Elazar Broad
Original Advisory:
http://lists.grok.org.uk/pipermail/full-disclosure/2008-July/063524.html
Filed under: Security and Anti-Virus, AntiVirus Information, Software Vulnerabilites