CSS Web Installer CSSWEBLib.Installer ActiveX InstallProduct1 Method Overflow

High Nessus Plugin ID 45043


The remote Windows host has an ActiveX control that is prone to a buffer overflow attack.


The CSS Web Installer ActiveX control, a component of the Authentium Command On Demand virus scanner, installed on the remote Windows host reportedly is affected by a buffer overflow involving the 'InstallProduct1' method, and possibly the 'InstallProduct' and 'InstallProduct2' methods as well.

If an attacker can trick a user on the affected host into viewing a specially crafted HTML document, he can leverage this issue to execute arbitrary code on the affected system subject to the user's privileges.


Remove or disable the control as the product is no longer supported.

See Also



Plugin Details

Severity: High

ID: 45043

File Name: css_web_installer_activex.nasl

Version: $Revision: 1.6 $

Type: local

Agent: windows

Family: Windows

Published: 2010/03/11

Modified: 2016/11/15

Dependencies: 13855

Risk Information

Risk Factor: High


Base Score: 9.3

Temporal Score: 8.4

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:F/RL:W/RC:ND

Vulnerability Information

Required KB Items: SMB/Registry/Enumerated

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 2010/03/04

Reference Information

BID: 38544

OSVDB: 62735

Secunia: 38844