-
Trend Micro OfficeScan Corporate Edition "ATXCONSOLE.OCX" Format String Vulnerability
Trend Micro OfficeScan Corporate Edition "ATXCONSOLE.OCX" Format String Vulnerability
Secunia Advisory: SA22224 Release Date: 2006-10-02
Ошибка форматной строки в ActiveX TrendMicro OfficeScan (format string) (в библиотеке элементов управления ATXCONSOLE.OCX).
security.nnov.ru
Critical: Moderately critical
Impact: DoS; System access
Where: From local network
Solution Status: Vendor Patch
Software: Trend Micro OfficeScan Corporate Edition 7.x
Description:
A vulnerability has been reported in Trend Micro OfficeScan Corporate Edition, which can be exploited by malicious people to potentially compromise a user's system.
The vulnerability is caused due to a format string error within the "ATXCONSOLE.OCX" ActiveX Control. This can potentially be exploited to execute arbitrary code by sending a specially crafted string back to the Management Console's Remote Client Install name search.
The vulnerability has been reported in Trend Micro OfficeScan Corporate Edition 7.3. Other versions may also be affected.
Solution: Reportedly, this has been fixed in OfficeScan Corporate Edition 7.3 Patch 1.
Provided and/or discovered by: Deral Heiland, Layered Defense
Original Advisory: http://www.layereddefense.com/TREND01OCT.html
Последний раз редактировалось Shu_b; 03.10.2006 в 11:08.
-
-
Будь в курсе!
Будь в курсе!
Надоело быть жертвой? Стань профи по информационной безопасности, получай самую свежую информацию об угрозах и средствах защиты от ведущего российского аналитического центра Anti-Malware.ru:
-
Trend Micro OfficeScan Client Removal and Arbitrary File Deletion
Trend Micro OfficeScan Client Removal and Arbitrary File Deletion
Secunia Advisory: SA22156 Release Date: 2006-10-03
Critical: Moderately critical
Impact: Manipulation of data; DoS
Where: From local network
Solution Status: Vendor Patch
Software:
Trend Micro OfficeScan Corporate Edition 6.x
Trend Micro OfficeScan Corporate Edition 7.x
Description:
Some vulnerabilities have been reported in Trend Micro OfficeScan Corporate Edition, which can be exploited by malicious people to cause a DoS (Denial of Service) or delete arbitrary files on a vulnerable system.
The vulnerabilities are caused due to unspecified errors within the OfficeScan CGI application. This can be exploited to silently remove OfficeScan clients or delete arbitrary files on an affected OfficeScan server by sending a specially crafted HTTP POST or GET request.
Solution:
OfficeScan Corporate Edition 6.5: http://www.trendmicro.com/ftp/produc...atch_b1418.exe
OfficeScan Corporate Edition 7.0: http://www.trendmicro.com/ftp/produc...atch_b1257.exe
OfficeScan Corporate Edition 7.3: http://www.trendmicro.com/ftp/produc...atch_b1053.exe
Provided and/or discovered by: Reported by the vendor.
Original Advisory: http://www.trendmicro.com/download/p...sp?productid=5
-