Panda Security ActiveScan 2.0 Update - Remote BoF Exploit

ID EDB-ID:6004
Type exploitdb
Reporter Karol Wiesek
Modified 2008-07-04T00:00:00


Panda Security ActiveScan 2.0 (Update) Remote BOF Exploit. CVE-2008-3155,CVE-2008-3156. Remote exploit for windows platform

                                            Author:  	Karol Wiesek <karol [at] wiesek {dizd0t} pl>

There exists two vulnerabilities in Panda Security ActiveScan 2.0 Update function.
1) typical overflow ( this exploit )
2) Update function allows to install any ( attacker suplied ) CABinet into victims system

Panda Security have not respond in any manner, thus i have no information of any patches, plans for patching ...


Panda has patched newest version, so update will not connect to custom ( attacker supplied ) URL.

Exploit: (2008-panda.tgz)

# [2008-07-04]