Kaspersky Online Scanner ActiveX Control Format String Vulnerability

Secunia ID	SA27187
CVE-ID	CVE-2007-3675
Release Date	11 Oct 2007
Criticality	Highly Critical
Solution Status	Vendor Patch
Software	Kaspersky Online Scanner 5.x
Where	From remote
Impact	System access This covers vulnerabilities where malicious people are able to gain system access and execute arbitrary code with the privileges of a local user.
Description	A vulnerability has been reported in Kaspersky Online Scanner, which can be exploited by malicious people to compromise a user's system. The vulnerability is caused due to a format string error in the kavwebscan.CKAVWebScan ActiveX control (kavwebscan.dll) when processing arguments passed to certain unspecified methods. This can be exploited to execute arbitrary code when a user e.g. visits a malicious website. The vulnerability affects versions 5.0.93.1 and prior.
Solution	Update to version 5.0.98.0. http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html
Reported by	Discovered by Stephen Fewer of Harmony Security and reported via iDefense Labs.
Original Advisory	Kaspersky: http://www.kaspersky.com/news?id=207575572 iDefense Labs: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=606