Update Protection against Trend Micro HouseCall "notifyOnLoadNative()" Vulnerability
| Check Point Reference: | CPAI-2009-025 | |
| Date Published: | ||
| Severity: | ||
| Source: | Secunia Research | |
| Industry Reference(s): | CVE-2008-2434 CVE-2008-2435 |
|
| Protection Provided by: |
IPS-1
|
|
| Who is Vulnerable? Trend Micro HouseCall ActiveX Control 6.51.0.1028 and 6.6.0.1278 | ||
| Vulnerability Description A vulnerability was reported in Trend Micro HouseCall . HouseCall is an application for checking whether your computer has been infected by viruses, spyware, or other malware. The vulnerability is caused by a use-after-free error in the HouseCall ActiveX control. This can be exploited to dereference previously freed memory by tricking the user into opening a web page containing a specially crafted function. Successful exploitation may allow remote code execution. |
||
|
Vulnerability Details The Trend Micro HouseCall ActiveX control (Housecall_ActiveX.dll) contains a use-after-free vulnerability. Using a web page containing a specially crafted call to notifyOnLoadNative(), an attacker can write to heap memory and potentially execute arbitrary code. |
Protection Overview
By enabling this protection, IPS-1 will detect and block attempts to access the ActiveX controls for Trend Micro HouseCall.
To configure the defense, select your product from the list below and follow the related protection steps.