[Full-Disclosure] Symantec, McAfee and Panda ActiveX controls

[Thomas Kristensen <tk@xxxxxxxxxxx>]

Hi Rafel,

We have analysed the reported vulnerabilities in the Symantec, McAfee
and Panda controls installed by their online scanners.

It appears that your conclusions for Symantec and McAfee are incorrect.
Following your examples seems to only cause null-pointer dereferences
and can therefore only be exploited to crash a browser.

However, the Panda issue is an exploitable heap overflow.

If you have any other information regarding Symantec and McAfee, which
proves that a buffer overflow exists then please publish this.

-- 
Kind regards,

Thomas Kristensen
CTO

Secunia
Toldbodgade 37B
1253 Copenhagen K
Denmark

Tlf.: +45 7020 5144
Fax:  +45 7020 5145

Free Virus Alerts via Email
http://secunia.com/secunia_virus_alerts/

Secunia Virus Information
http://secunia.com/virus_information/

Free Secunia Advisories via Email
http://secunia.com/secunia_security_advisories/

Secunia Advisories
http://secunia.com/advisories/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html