Secunia

Rafel Ivgi has discovered a vulnerability in BitDefender AvxScanOnline ActiveX Control, which can be exploited by malicious people to compromise a user's system.

The AvxScanOnline ActiveX Control is a component installed by BitDefender Scan Online on a user's system the first time an online scanning is performed.

The vulnerability is caused due to an insecure method ("RequestFile()") in the ActiveX control, which allows an arbitrary file to downloaded from a server and then executed on the user's system.

Successful exploitation may allow execution of arbitrary code on a user's system by e.g. tricking the user into visiting a malicious website.

It is reportedly also possible to see the content of all drives and folders on a user's system via the affected control.

Solution
The vendor has issued an updated version of the ActiveX control.

Provided and/or discovered by
Rafel Ivgi

Deep Links
Links available in Customer Area