Kaspersky Online Scanner kavwebscan.CKAVWebScan ActiveX (kavwebscan.dll) Format String Arbitrary Code Execution

This script is Copyright (C) 2007-2016 Tenable Network Security, Inc.


Synopsis :

The remote Windows host has an ActiveX control that is affected by a
format string vulnerability.

Description :

The remote host contains the Kaspersky Online Scanner, an online virus
scanner for Windows.

The version of the Kaspersky Web Scanner ActiveX control installed as
part of this software on the remote host contains a format string
vulnerability. By tricking a user on the affected host into visiting
a specially crafted web page, an attacker may be able to use this
method to execute arbitrary code on the affected system subject to the
user's privileges.

See also :

http://www.nessus.org/u?de2e5272
http://seclists.org/bugtraq/2007/Oct/148
http://www.kaspersky.com/news?id=207575572

Solution :

Upgrade to Kaspersky Online Scanner version 5.0.98.0 or later.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 6.9
(CVSS2#E:U/RL:OF/RC:C)
Public Exploit Available : false

Family: Windows

Nessus Plugin ID: 26969 (kaspersky_webscanner_activex_format_string.nasl)

Bugtraq ID: 26004

CVE ID: CVE-2007-3675

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now