CVE-2008-0470

published 2008-01-29

CVE-2008-0470: A certain ActiveX control in Comodo AntiVirus 2.0 allows remote attackers to execute arbitrary commands via the ExecuteStr method.

Priority P2 60 critical 9.3 CVSS 2.0

AV N AC M Au N C C I C A C

EXPLOIT

A certain ActiveX control in Comodo AntiVirus 2.0 allows remote attackers to execute arbitrary commands via the ExecuteStr method.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
comodo	comodo_antivirus	—	—

Detection & IOCs extracted from sources · hover to see the quote

command obj.ExecuteStr('cmd.exe', '/C echo "hello world" && pause')↗

• → Monitor for ActiveX method calls to 'ExecuteStr' originating from browser processes (e.g., iexplore.exe), which may indicate exploitation of the Comodo AntiVirus 2.0 ActiveX control to execute arbitrary commands. ↗
• → Look for child processes (e.g., cmd.exe) spawned by Internet Explorer (iexplore.exe) as a result of ActiveX ExecuteStr method invocation. ↗

• · Exploit was specifically tested against Comodo AntiVirus Beta 2.0 and Microsoft Internet Explorer 6; applicability to other versions or browsers is unconfirmed. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.