Secunia

Greg Linares has reported a vulnerability in BitDefender Online Scanner, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an input validation error within the OScan8.ocx / OScan81.ocx ActiveX control when handling arguments passed to the "InitX()" method. This can be exploited to cause a heap-based buffer overflow by prepending two "%" characters to the argument of the affected method.

Successful exploitation allows execution of arbitrary code.

The vulnerability is reported in version 8.0. Other versions may also be affected.

Solution
Update to the latest version (OScan82.ocx).
Further details available in Customer Area

Provided and/or discovered by
Greg Linares, eEye Digital Security

Changelog
Further details available in Customer Area

Original Advisory
http://research.eeye.com/html/advisories/published/AD20071120.html

Deep Links
Links available in Customer Area