Signature Detail

HTTP: Symantec Products SupportSoft Buffer Overflow

This signature detects attempts to exploit a known vulnerability against Symantec's SupportSoft ActiveX control in various products. An attacker can create a malicious Web page containing dangerous ActiveX calls, which if visited, can allow the attacker to gain control of the victim's system.

Extended Description

SupportSoft ActiveX controls are prone to multiple remote buffer-overflow vulnerabilities because the software fails to properly bounds-check user-supplied input prior to copying it to insufficiently sized memory buffers. Exploiting these issues allows remote attackers to execute arbitrary machine code in the context of applications that employ the vulnerable controls (typically Microsoft Internet Explorer). The affected software component is included in several third-party applications.

Affected Products

• Supportsoft activex_control
• Symantec automated_support_assistant
• Symantec norton_antivirus_2006
• Symantec norton_internet_security_2006_professional_edition
• Symantec norton_system_works_2006

References

• BugTraq: 22564
• CVE: CVE-2006-6490
• URL: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=478
• URL: http://securityresponse.symantec.com/avcenter/security/Content/2007.02.22.html