Trend Micro OfficeScan Corporate Edition "ATXCONSOLE.OCX" Format String Vulnerability
Secunia Advisory: SA22224 Release Date: 2006-10-02
Ошибка форматной строки в ActiveX TrendMicro OfficeScan (format string) (в библиотеке элементов управления ATXCONSOLE.OCX).
Critical: Moderately critical
Impact: DoS; System access
Where: From local network
Solution Status: Vendor Patch
Software: Trend Micro OfficeScan Corporate Edition 7.x
A vulnerability has been reported in Trend Micro OfficeScan Corporate Edition, which can be exploited by malicious people to potentially compromise a user's system.
The vulnerability is caused due to a format string error within the "ATXCONSOLE.OCX" ActiveX Control. This can potentially be exploited to execute arbitrary code by sending a specially crafted string back to the Management Console's Remote Client Install name search.
The vulnerability has been reported in Trend Micro OfficeScan Corporate Edition 7.3. Other versions may also be affected.
Solution: Reportedly, this has been fixed in OfficeScan Corporate Edition 7.3 Patch 1.
Provided and/or discovered by: Deral Heiland, Layered Defense
Original Advisory: http://www.layereddefense.com/TREND01OCT.html