Added: 08/11/2008
CVE: CVE-2008-3364
BID: 30407
OSVDB: 47213
Trend Micro OfficeScan is a centralized virus and security scan management system.
A buffer overflow in the objRemoveCtrl ActiveX control, which is automatically installed when OfficeScan is installed through the server web console, allows command execution when invoked with a long, specially crafted Server property.
Apply a security patch from Trend Micro.
<http://www.frsirt.com/english/advisories/2008/2220/references>
Exploit works on the ActiveX control which comes with Trend Micro OfficeScan 7.3.
The vulnerable ActiveX component is installed by accessing the following URL: http://<OfficeScan Server>:8080/
Windows