Panda ActiveScan 'as2stubie.dll' ActiveX Control Remote Code Execution Vulnerability

Bugtraq ID:	38067
Class:	Design Error
CVE:	CVE-2009-3735
Remote:	Yes
Local:	No
Published:	Feb 09 2010 12:00AM
Updated:	Feb 09 2010 07:31PM
Credit:	Will Dormann of CERT/CC.
Vulnerable:	Panda ActiveScan 2.0
Not Vulnerable:

Panda ActiveScan 'as2stubie.dll' ActiveX Control Remote Code Execution Vulnerability

Panda ActiveScan ActiveX control is prone to a remote code-execution vulnerability.

Attackers may exploit this issue by enticing unsuspecting victims to view a malicious webpage.

Successful exploits will allow attackers to execute arbitrary code within the context of the application that uses the ActiveX control (typically Internet Explorer).

Panda ActiveScan 2.0 is vulnerable; other versions may also be affected.

Panda ActiveScan 'as2stubie.dll' ActiveX Control Remote Code Execution Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Panda ActiveScan 'as2stubie.dll' ActiveX Control Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references for details.

Panda ActiveScan 'as2stubie.dll' ActiveX Control Remote Code Execution Vulnerability

References:

• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• Panda Software Homepage (Panda Software)
  
• Vulnerability Note VU#869993 (US-CERT)
  
• Microsoft Security Bulletin MS10-008 (Microsoft)