CSS Web Installer CSSWEBLib.Installer ActiveX InstallProduct1 Method Overflow
High Nessus Plugin ID 45043
SynopsisThe remote Windows host has an ActiveX control that is prone to a buffer overflow attack.
DescriptionThe CSS Web Installer ActiveX control, a component of the Authentium Command On Demand virus scanner, installed on the remote Windows host reportedly is affected by a buffer overflow involving the 'InstallProduct1' method, and possibly the 'InstallProduct' and 'InstallProduct2' methods as well.
If an attacker can trick a user on the affected host into viewing a specially crafted HTML document, he can leverage this issue to execute arbitrary code on the affected system subject to the user's privileges.
SolutionRemove or disable the control as the product is no longer supported.