|
|
| |
Credit:
The information has been provided by Secunia Research.
The original article can be found at: http://secunia.com/secunia_research/2008-34/
|
| |
Vulnerable Systems:
* Trend Micro HouseCall ActiveX Control version 6.51.0.1028
* Trend Micro HouseCall ActiveX Control version 6.6.0.1278
Immune Systems:
* Trend Micro HouseCall ActiveX Control version 6.6.0.1285
The vulnerability is caused by a use-after-free error in the HouseCall ActiveX control (Housecall_ActiveX.dll). This can be exploited to dereference previously freed memory by tricking the user into opening a web page containing a specially crafted "notifyOnLoadNative()" callback function.
Successful exploitation allows execution of arbitrary code.
Solution:
Remove the ActiveX control and install version 6.6.0.1285 available from: http://prerelease.trendmicro-europe.com/hc66/launch/
HouseCall Server Edition:
* Apply hot fix B1285.
Time Table:
25/08/2008 - Vendor notified.
26/08/2008 - Vendor response.
21/12/2008 - Public disclosure.
CVE Information:
CVE-2008-2435
|
|
|
