====================================================================== Secunia Research 22/12/2008 - Trend Micro HouseCall ActiveX Control Arbitrary Code Execution - ====================================================================== Table of Contents Affected Software....................................................1 Severity.............................................................2 Vendor's Description of Software.....................................3 Description of Vulnerability.........................................4 Solution.............................................................5 Time Table...........................................................6 Credits..............................................................7 References...........................................................8 About Secunia........................................................9 Verification........................................................10 ====================================================================== 1) Affected Software * Trend Micro HouseCall ActiveX Control 6.51.0.1028 and 6.6.0.1278 NOTE: Other versions may also be affected. ====================================================================== 2) Severity Rating: Highly critical Impact: System comprimse Where: Remote ====================================================================== 3) Vendor's Description of Software "Trend Micro? HouseCall is an application for checking whether your computer has been infected by viruses, spyware, or other malware. HouseCall performs additional security checks to identify and fix vulnerabilities to prevent reinfection." Product Link: http://housecall.trendmicro.com/ ====================================================================== 4) Description of Vulnerability Secunia Research has discovered a vulnerability in Trend Micro HouseCall, which can be exploited by malicious people to compromise a user's system. The vulnerability is caused due to an implementation error within the HouseCall ActiveX control (Housecall_ActiveX.dll). This can be exploited to e.g. download and load an arbitrary library file by specifying a custom update server. Successful exploitation allows execution of arbitrary code. ====================================================================== 5) Solution Remove the ActiveX control and install version 6.6.0.1285. http://prerelease.trendmicro-europe.com/hc66/launch/ HouseCall Server Edition: Apply hotfix B1285. ====================================================================== 6) Time Table 18/08/2008 - Vendor notified. 19/08/2008 - Vendor response. 02/09/2008 - Vendor acknowledges vulnerability. 03/09/2008 - Vendor asks if version 6.6 is also affected. 03/09/2008 - Vendor informed that version 6.6 is not available. 09/09/2008 - Vendor informs that version 6.6 site is now accessible. 18/09/2008 - Vendor informed that version 6.6 is not affected by the current exploit, but will be checked in-depth later. 23/09/2008 - Vendor informed that version 6.6 is also vulnerable when using a slightly modified exploit. 27/09/2008 - Vendor provides status update. 13/11/2008 - Status update requested. 13/11/2008 - Vendor provides status update. 14/11/2008 - Vendor provides hotfix for testing. 14/11/2008 - Informed the vendor that the supplied hotfix does not address the vulnerability properly. 18/11/2008 - Vendor requests updated exploit. 19/11/2008 - Updated exploit sent to the vendor. 22/12/2008 - Status update requested. 22/12/2008 - Vendor informs that hotfix for SA31583 also fixes this vulnerability. 22/12/2008 - Public disclosure. ====================================================================== 7) Credits Discovered by Alin Rad Pop, Secunia Research. ====================================================================== 8) References The Common Vulnerabilities and Exposures (CVE) project has assigned CVE-2008-2434 for the vulnerability. ====================================================================== 9) About Secunia Secunia offers vulnerability management solutions to corporate customers with verified and reliable vulnerability intelligence relevant to their specific system configuration: http://secunia.com/advisories/business_solutions/ Secunia also provides a publicly accessible and comprehensive advisory database as a service to the security community and private individuals, who are interested in or concerned about IT-security. http://secunia.com/advisories/ Secunia believes that it is important to support the community and to do active vulnerability research in order to aid improving the security and reliability of software in general: http://secunia.com/secunia_research/ Secunia regularly hires new skilled team members. Check the URL below to see currently vacant positions: http://secunia.com/corporate/jobs/ Secunia offers a FREE mailing list called Secunia Security Advisories: http://secunia.com/advisories/mailing_lists/ ====================================================================== 10) Verification Please verify this advisory by visiting the Secunia website: http://secunia.com/secunia_research/2008-32/ Complete list of vulnerability reports published by Secunia Research: http://secunia.com/secunia_research/ ======================================================================