HTTP: Symantec Products SupportSoft Buffer Overflow

This signature detects attempts to exploit a known vulnerability against Symantec's SupportSoft ActiveX control in various products. An attacker can create a malicious Web page containing dangerous ActiveX calls, which if visited, can allow the attacker to gain control of the victim's system.

Extended Description

SupportSoft ActiveX controls are prone to multiple remote buffer-overflow vulnerabilities because the software fails to properly bounds-check user-supplied input prior to copying it to insufficiently sized memory buffers. Exploiting these issues allows remote attackers to execute arbitrary machine code in the context of applications that employ the vulnerable controls (typically Microsoft Internet Explorer). The affected software component is included in several third-party applications.

Affected Products

Supportsoft activex_control

References

BugTraq: 22564

CVE: CVE-2006-6490

URL: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=478 http://securityresponse.symantec.com/avcenter/security/Content/2007.02.22.html

Short Name

HTTP:STC:CLSID:ACTIVEX:SYM-SS

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Symantec Products SupportSoft Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?