Signature Detail

HTTP: Trend Micro OfficeScan ActiveX Control Buffer Overflow

This signature detects attempts to exploit a known vulnerability against Trend Micro OfficeScan. An attacker can create a malicious Web page containing dangerous ActiveX calls, which if visited, can allow the attacker to gain control of the victim's system.

Extended Description

Trend Micro OfficeScan Client is prone to a remote buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer. Exploiting this issue allows remote attackers to execute arbitrary code in the context of applications using the affected ActiveX control and to compromise affected computers. Failed attempts will likely result in denial-of-service conditions.

Affected Products

• Trend Micro OfficeScan Corporate Edition 7.0.0
• Trend Micro OfficeScan Corporate Edition 7.3

References

• BugTraq: 22585
• CVE: CVE-2007-0325
• URL: http://www.trendmicro.com/ftp/documentation/readme/osce_70_win_en_securitypatch_1344_readme.txt