full-disclosure - Symantec, McAfee and Panda ActiveX controls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1081341423.12786.2372.camel@LTSP>
From: tk at secunia.com (Thomas Kristensen)
Subject: Symantec, McAfee and Panda ActiveX controls

Hi Rafel,

We have analysed the reported vulnerabilities in the Symantec, McAfee
and Panda controls installed by their online scanners.

It appears that your conclusions for Symantec and McAfee are incorrect.
Following your examples seems to only cause null-pointer dereferences
and can therefore only be exploited to crash a browser.

However, the Panda issue is an exploitable heap overflow.

If you have any other information regarding Symantec and McAfee, which
proves that a buffer overflow exists then please publish this.

-- 
Kind regards,

Thomas Kristensen
CTO

Secunia
Toldbodgade 37B
1253 Copenhagen K
Denmark

Tlf.: +45 7020 5144
Fax:  +45 7020 5145

Free Virus Alerts via Email
http://secunia.com/secunia_virus_alerts/

Secunia Virus Information
http://secunia.com/virus_information/

Free Secunia Advisories via Email
http://secunia.com/secunia_security_advisories/

Secunia Advisories
http://secunia.com/advisories/