Elazar Broad has discovered some vulnerabilities in Trend Micro OfficeScan, which can be exploited by malicious people to compromise a user's system.

The vulnerabilities are caused due to boundary errors in the OfficeScan Corp Edition Web-Deployment ObjRemoveCtrl Class ActiveX control (OfficeScanRemoveCtrl.dll) on an OfficeScan client when attempting to display a list of configuration settings. These can be exploited to cause stack-based buffer overflows by passing overly long properties when a user e.g. visits a malicious web site.

Successful exploitation allows execution of arbitrary code, but requires that OfficeScan client was installed using web deployment.

The vulnerabilities are confirmed in version 7.3 build 1343(Patch 4). Other versions may also be affected.

Solution
Apply critical patches.
Further details available in Customer Area

Provided and/or discovered by
Elazar Broad

Changelog
Further details available in Customer Area

Original Advisory
Trend Micro:
http://www.trendmicro.com/ftp/documentation/readme/OSCE_7.3_Win_EN_CriticalPatch_B1355_Readme.txt

Elazar Broad:
http://lists.grok.org.uk/pipermail/full-disclosure/2008-July/063524.html

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area