[原文]Multiple heap-based and stack-based buffer overflows in certain DCOM server components in VERITAS Storage Exec Storage Exec 5.3 before Hotfix 9 and StorageCentral 5.2 before Hot Fix 2 allow remote attackers to execute arbitrary code via certain ActiveX controls.
Veritas Storage Exec is susceptible to multiple remote buffer overflow vulnerabilities. These issues are due to the lack of proper bounds checking of user-supplied data prior to copying it to fixed size memory buffers.
These issues are located in multiple DCOM servers in the affected product. Both stack-based, and heap-based overflows are identified. By calling associated ActiveX controls, attackers may exploit these overflows to execute arbitrary machine code.
These vulnerabilities may be exploited by visiting malicious Web sites, or viewing HTML email containing malicious script code.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: firstname.lastname@example.org <mailto:email@example.com>.
Symantec has released advisory SYM05-014, along with fixes to address these issues. Please see the referenced advisory for further information.