Authentium Command Antivirus contains multiple ActiveX vulnerabilities, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.
Authentium Command Antivirus provides multiple ActiveX controls. Many of the ActiveX controls provided by odapi.dll are vulnerable to buffer overflows. Note that Command Antivirus components may come with software bundles from ISPs or other sources.
By convincing a user to view a specially crafted HTML document (e.g., a web page or an HTML email message or attachment), an attacker may be able to execute arbitrary code with the privileges of the user. The attacker could also cause Internet Explorer (or the program using the WebBrowser control) to crash.
This issue is resolved in Command Antivirus 4.93.8. Please check with your software vendor for updates. If no updates are available from your vendor, please consider the following workarounds
Disable the vulnerable Command Antivirus ActiveX controls in Internet Explorer
This vulnerability was reported by Will Dormann of CERT/CC.
This document was written by Will Dormann.
|Date First Published:||2007-05-31|
|Date Last Updated:||2007-06-01 20:02 UTC|