Signature Detail

HTTP: Trend Micro OfficeScan objRemoveCtrl ActiveX Exploit

This signature detects attempts to exploit a known vulnerability in Trend Micro OfficeScan objRemoveCtrl ActiveX control. An attacker can create a malicious Web site containing dangerous ActiveX calls, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.

Extended Description

A Trend Micro OfficeScan ActiveX control is prone to multiple stack-based buffer-overflow vulnerabilities. An attacker can exploit these issues by enticing a victim into viewing a malicious web page. A successful exploit will allow attacker-supplied code to run in the context of the currently logged-in user. The following products are vulnerable: OfficeScan 7.0 OfficeScan 7.3 OfficeScan 8.0 Worry-Free Business Security 5.0 Client Server Messaging Security for SMB 3.5 Client Server Messaging Security for SMB 3.6

Affected Products

• Trend Micro Client Server Messaging Security for SMB 3.5
• Trend Micro Client Server Messaging Security for SMB 3.6
• Trend Micro OfficeScan Corporate Edition 7.0
• Trend Micro OfficeScan Corporate Edition 7.3
• Trend Micro OfficeScan Corporate Edition 8.0
• Trend Micro Worry-Free Business Security 5.0

References

• BugTraq: 30407
• CVE: CVE-2008-3364
• URL: http://lists.grok.org.uk/pipermail/full-disclosure/2008-July/063524.html
• URL: http://www.milw0rm.com/exploits/6152