Karol Wiesek has reported two vulnerabilities in Panda ActiveScan, which can be exploited by malicious people to compromise a user's system.

1) A boundary error in the ActiveScan 2.0 AV Class ActiveX control (as2guiie.dll) when processing input supplied to the "Update()" method can be exploited to cause a stack-based buffer overflow via a specially crafted web page.

2) A design error in the ActiveScan 2.0 AV Class ActiveX control allows installing arbitrary cabinet files on a user's system via the "Update()" method.

Successful exploitation allows execution of arbitrary code.

According to the vendor, the vulnerabilities affect versions prior to version 1.02.00.

Solution
Update to version 1.02.00 or later.
Further details available in Customer Area

Provided and/or discovered by
Karol Wiesek

Changelog
Further details available in Customer Area

Original Advisory
http://lists.grok.org.uk/pipermail/full-disclosure/2008-July/063061.html

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area