Authentium Command Antivirus ActiveX Control ODAPI.DLL Multiple Buffer Overflow Vulnerabilities

Bugtraq ID:	24255
Class:	Boundary Condition Error
CVE:	CVE-2007-2917
Remote:	Yes
Local:	No
Published:	May 31 2007 12:00AM
Updated:	Jun 01 2007 04:31PM
Credit:	Will Dormann is credited with the discovery of this issue.
Vulnerable:	Authentium Command Antivirus 4.93.7 Authentium Command Antivirus 4.93.6 Authentium Command Antivirus 4.93.5 Authentium Command Antivirus 4.93.4 Authentium Command Antivirus 4.93.3 Authentium Command Antivirus 4.93.2 Authentium Command Antivirus 4.93.1
Not Vulnerable:	Authentium Command Antivirus 4.93.8

Authentium Command Antivirus ActiveX Control ODAPI.DLL Multiple Buffer Overflow Vulnerabilities

Authentium Command Antivirus ActiveX control is prone to multiple buffer-overflow vulnerabilities because it fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.

This issue affects Command Antivirus 4.93.7 and earlier. Authentium Command Antivirus components may be distributed with software bundles from ISPs or other sources.

Authentium Command Antivirus ActiveX Control ODAPI.DLL Multiple Buffer Overflow Vulnerabilities

Attacker may exploit this issue by enticing a victim into opening a maliciously crafted webpage.

Authentium Command Antivirus ActiveX Control ODAPI.DLL Multiple Buffer Overflow Vulnerabilities

Solution:
The vendor released version 4.93.8 to address this issue. Please contact the vendor for more information.

Authentium Command Antivirus ActiveX Control ODAPI.DLL Multiple Buffer Overflow Vulnerabilities

References:

• Authentium Homepage (Authentium)
  
• VU#563401: Authentium Command Antivirus odapi.dll multiple ActiveX buffer overfl (CERT-US)