Panda Antivirus EXE File Remote Code Execution Vulnerability

Bugtraq ID:	24989
Class:	Boundary Condition Error
CVE:	CVE-2007-3969
Remote:	Yes
Local:	No
Published:	Jul 20 2007 12:00AM
Updated:	May 07 2015 05:36PM
Credit:	Sergio Alvarez of n.runs AG discovered this issue.
Vulnerable:	Panda Antivirus 0
Not Vulnerable:

Panda Antivirus EXE File Remote Code Execution Vulnerability

Panda Antivirus is prone to a remote code-execution vulnerability because the application fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

Successful exploits may result in arbitrary code-execution with SYSTEM-level privileges. This facilitates the complete remote compromise of affected computers.

Versions of Panda Antivirus prior to 20 July 2007 are vulnerable to this issue.

Panda Antivirus EXE File Remote Code Execution Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Panda Antivirus EXE File Remote Code Execution Vulnerability

Solution:
The reporter of this issue states that the vendor has addressed the vulnerability as of July 20, 2007. Users of affected packages should contact the vendor for more information.

The application's automatic update feature will reportedly apply fixes.

Panda Antivirus EXE File Remote Code Execution Vulnerability

References:

• Panda Software Homepage (Panda Software)
  
• 2007-07-20 - n.runs-SA-2007.019 - Panda Antivirus EXE parsing Arbitrary Code Exe ([email protected])