HTTP: Trend Micro OfficeScan objRemoveCtrl ActiveX Exploit

This signature detects attempts to exploit a known vulnerability in Trend Micro OfficeScan objRemoveCtrl ActiveX control. An attacker can create a malicious Web site containing dangerous ActiveX calls, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.

Extended Description

A Trend Micro OfficeScan ActiveX control is prone to multiple stack-based buffer-overflow vulnerabilities. An attacker can exploit these issues by enticing a victim into viewing a malicious web page. A successful exploit will allow attacker-supplied code to run in the context of the currently logged-in user. The following products are vulnerable: OfficeScan 7.0 OfficeScan 7.3 OfficeScan 8.0 Worry-Free Business Security 5.0 Client Server Messaging Security for SMB 3.5 Client Server Messaging Security for SMB 3.6

Affected Products

Trend_micro client_server_messaging_security_for_smb

Short Name
HTTP:STC:ACTIVEX:TM-OS
Severity
Major
Recommended
False
Recommended Action
Drop
Category
HTTP
Keywords
ActiveX CVE-2008-3364 Exploit Micro OfficeScan Trend bid:30407 objRemoveCtrl
Release Date
08/06/2008
Supported Platforms

srx-branch-12.3

srx-19.3

srx-branch-19.3

vsrx3bsd-19.2

srx-branch-19.4

vsrx-19.4

mx-12.3

mx-19.4

vmx-19.4

mx-19.3

vsrx3bsd-19.4

srx-19.4

vsrx-12.3

vmx-19.3

vsrx-19.2

srx-12.3

Sigpack Version
3724
False Positive
Unknown
Vendors

Trend_micro

CVSS Score

9.3

Found a potential security threat?