__________________________________________________________
	
						   The U.S. Department of Energy
					   Computer Incident Advisory Capability
							   ___  __ __    _     ___
							  /       |     /_\   /
							  \___  __|__  /   \  \___
				 __________________________________________________________
	
								 INFORMATION BULLETIN
	
					   Authentium Command Antivirus Vulnerability
						 [US-CERT Vulnerability Note VU#563401]
	
	June 4, 2007 17:00 GMT                                            Number R-259
	______________________________________________________________________________
	PROBLEM:       Authentium Command Antivirus contains multiple ActiveX 
				   vulnerabilities, which can allow a remote, unauthenticated 
				   attacker to execute arbitrary code on a vulnerable system. 
	PLATFORM:      Command Antivirus 4.93.7 
	DAMAGE:        Can allow a remote, unauthenticated attacker to execute 
				   arbitrary code on a vulnerable system. 
	SOLUTION:      Upgrade to the appropriate version. 
	______________________________________________________________________________
	VULNERABILITY  The risk is MEDIUM. Can allow a remote, unauthenticated 
	ASSESSMENT:    attacker to execute arbitrary code on a vulnerable system. 
	______________________________________________________________________________
	LINKS: 
	 CIAC BULLETIN:      http://www.ciac.org/ciac/bulletins/r-259.shtml 
	 ORIGINAL BULLETIN:  http://www.kb.cert.org/vuls/id/563401 
	 CVE:                http://www.cve.mitre.org/cgi-bin/cvename.cgi?name= 
						 CVE-2007-2917 
	______________________________________________________________________________
	[***** Start US-CERT Vulnerability Note VU#563401 *****]
	
	Vulnerability Note VU#563401
	Authentium Command Antivirus odapi.dll multiple ActiveX buffer overflows
	
	Overview
	Authentium Command Antivirus contains multiple ActiveX vulnerabilities, which 
	can allow a remote, unauthenticated attacker to execute arbitrary code on a 
	vulnerable system. 
	
	I. Description
	Authentium Command Antivirus provides multiple ActiveX controls. Many of the 
	ActiveX controls provided by odapi.dll are vulnerable to buffer overflows. Note 
	that Command Antivirus components may come with software bundles from ISPs or 
	other sources.
	
	II. Impact
	By convincing a user to view a specially crafted HTML document (e.g., a web 
	page or an HTML email message or attachment), an attacker may be able to execute 
	arbitrary code with the privileges of the user. The attacker could also cause 
	Internet Explorer (or the program using the WebBrowser control) to crash.
	
	III. Solution
	This issue is resolved in Command Antivirus 4.93.8. Please check with your 
	software vendor for updates. If no updates are available from your vendor, please 
	consider the following workarounds 
	
	Disable the vulnerable Command Antivirus ActiveX controls in Internet Explorer
	
	The vulnerable ActiveX control can be disabled in Internet Explorer by setting 
	the kill bit for the following CLSID:
	
	
	{103CAE29-DB09-4F77-812B-FFC0C3BC91A1}
	{1F22F6F1-FDC5-4C6D-9335-B6E31315FB1B}
	{253A6409-6917-48EF-9CC7-9CB79FDA4169}
	{50F3C8D1-E5E8-463D-A6E5-5A5966359538}
	{567408B9-78B1-44DD-9CC2-7AC136C916C5}
	{67EC8D27-C3CD-447E-9315-46A04DDB6C35}
	{6D855303-A902-4608-8668-C177F80AB429}
	{8EDDD996-E47F-4C59-8505-9FC570612FB6}
	{A1962F85-324C-4751-83ED-27426F9F6E36}
	{FED9DA10-9C9E-4AEB-B5B2-51C7ADC7A4DA}
	
	More information about how to set the kill bit is available in Microsoft Support 
	Document 240797. Alternatively, the following text can be saved as a .REG file 
	and imported to set the kill bit for this control:
	
	Windows Registry Editor Version 5.00
	
	[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\
	{103CAE29-DB09-4F77-812B-FFC0C3BC91A1}]
	"Compatibility Flags"=dword:00000400
	
	[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\
	{1F22F6F1-FDC5-4C6D-9335-B6E31315FB1B}]
	"Compatibility Flags"=dword:00000400
	
	[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\
	{253A6409-6917-48EF-9CC7-9CB79FDA4169}]
	"Compatibility Flags"=dword:00000400
	
	[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\
	{50F3C8D1-E5E8-463D-A6E5-5A5966359538}]
	"Compatibility Flags"=dword:00000400
	
	[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\
	{567408B9-78B1-44DD-9CC2-7AC136C916C5}]
	"Compatibility Flags"=dword:00000400
	
	[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\
	{67EC8D27-C3CD-447E-9315-46A04DDB6C35}]
	"Compatibility Flags"=dword:00000400
	
	[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\
	{6D855303-A902-4608-8668-C177F80AB429}]
	"Compatibility Flags"=dword:00000400
	
	[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\
	{8EDDD996-E47F-4C59-8505-9FC570612FB6}]
	"Compatibility Flags"=dword:00000400
	
	[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\
	{A1962F85-324C-4751-83ED-27426F9F6E36}]
	"Compatibility Flags"=dword:00000400
	
	[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\
	{FED9DA10-9C9E-4AEB-B5B2-51C7ADC7A4DA}]
	"Compatibility Flags"=dword:00000400
	
	Disable ActiveX
	
	Disabling ActiveX controls in the Internet Zone (or any zone used by an attacker) 
	appears to prevent exploitation of this and other ActiveX vulnerabilities. 
	Instructions for disabling ActiveX in the Internet Zone can be found in the 
	"Securing Your Web Browser" document.  
	
	Systems Affected
	Vendor Status Date Updated 
	Authentium, Inc.  Vulnerable 30-May-2007 
	BellSouth Vulnerable 30-May-2007 
	Earthlink Vulnerable 30-May-2007 
	PeoplePC, Inc. Vulnerable 30-May-2007 
	
	References
	http://www.cert.org/tech_tips/securing_browser/#Internet_Explorer
	http://support.microsoft.com/kb/240797
	http://secunia.com/advisories/25500/ 
	
	Credit
	This vulnerability was reported by Will Dormann of CERT/CC. 
	
	This document was written by Will Dormann. 
	
	Other Information
	Date Public 05/31/2007 
	Date First Published 05/31/2007 02:34:59 PM 
	Date Last Updated 06/01/2007 
	CERT Advisory   
	CVE Name CVE-2007-2917 
	Metric 4.59 
	Document Revision 11 
	
	
	[***** End US-CERT Vulnerability Note VU#563401 *****]
	_______________________________________________________________________________
	
	CIAC wishes to acknowledge the contributions of US-CERT for the 
	information contained in this bulletin.
	_______________________________________________________________________________
	
	
	CIAC, the Computer Incident Advisory Capability, is the computer
	security incident response team for the U.S. Department of Energy
	(DOE) and the emergency backup response team for the National
	Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
	National Laboratory in Livermore, California. CIAC is also a founding
	member of FIRST, the Forum of Incident Response and Security Teams, a
	global organization established to foster cooperation and coordination
	among computer security teams worldwide.
	
	CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
	can be contacted at:
		Voice:    +1 925-422-8193 (7x24)
		FAX:      +1 925-423-8002
		STU-III:  +1 925-423-2604
		E-mail:   ciac@ciac.org
	
	Previous CIAC notices, anti-virus software, and other information are
	available from the CIAC Computer Security Archive.
	
	   World Wide Web:      http://www.ciac.org/
	   Anonymous FTP:       ftp.ciac.org
	
	PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
	communities receive CIAC bulletins.  If you are not part of these
	communities, please contact your agency's response team to report
	incidents. Your agency's team will coordinate with CIAC. The Forum of
	Incident Response and Security Teams (FIRST) is a world-wide
	organization. A list of FIRST member organizations and their
	constituencies can be obtained via WWW at http://www.first.org/.
	
	This document was prepared as an account of work sponsored by an
	agency of the United States Government. Neither the United States
	Government nor the University of California nor any of their
	employees, makes any warranty, express or implied, or assumes any
	legal liability or responsibility for the accuracy, completeness, or
	usefulness of any information, apparatus, product, or process
	disclosed, or represents that its use would not infringe privately
	owned rights. Reference herein to any specific commercial products,
	process, or service by trade name, trademark, manufacturer, or
	otherwise, does not necessarily constitute or imply its endorsement,
	recommendation or favoring by the United States Government or the
	University of California. The views and opinions of authors expressed
	herein do not necessarily state or reflect those of the United States
	Government or the University of California, and shall not be used for
	advertising or product endorsement purposes.
	
	LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)
	
	R-249: Avast! Antivirus Vulnerability
	R-250: File Security Update
	R-251: Apple QuickTime 7.1.6 Security Update
	R-252: Mozilla Layout Engine Vulnerable
	R-253: SeaMonkey Security Update
	R-254: Thunderbird Security Update
	R-255: Firefox Security Update
	R-256: Logitech VideoCall Vulnerabilities
	R-257: Open Ticket Request System (OTRS) Vulnerability
	R-258: FLEXnet Connect 6.0 Security Patch