Signature Detail

HTTP: Symantec Products SupportSoft Buffer Overflow

This signature detects attempts to exploit a known vulnerability against Symantec's SupportSoft ActiveX control in various products. An attacker can create a malicious Web page containing dangerous ActiveX calls, which if visited, can allow the attacker to gain control of the victim's system.

Extended Description

SupportSoft ActiveX controls are prone to multiple remote buffer-overflow vulnerabilities because the software fails to properly bounds-check user-supplied input prior to copying it to insufficiently sized memory buffers. Exploiting these issues allows remote attackers to execute arbitrary machine code in the context of applications that employ the vulnerable controls (typically Microsoft Internet Explorer). The affected software component is included in several third-party applications.

Affected Products

• SupportSoft ActiveX Control
• Symantec Automated Support Assistant
• Symantec Norton AntiVirus 2006
• Symantec Norton Internet Security 2006 Professional Edition
• Symantec Norton System Works 2006

References

• BugTraq: 22564
• CVE: CVE-2006-6490
• URL: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=478
• URL: http://securityresponse.symantec.com/avcenter/security/Content/2007.02.22.html