Zero-day Vulnerability Database

Change view:

Zero-day vulnerabilities discovered: 1

Remote code execution in Xunlei Thunder
CVE-2007-6144

Heap-based buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error in PPlayer.XPPlayer.1 ActiveX control when handling long strings passed via FlvPlayerUrl property value. A remote attacker can create a specially crafted web page, trick the victim into visiting it, cause a heap-based buffer overflow and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability was being actively exploited.

Not patched
i

This vulnerability was first reported on SEBUG.net. This vulnerability was used in mass SQL injection attack against Chinese websites in May 2008.

Software: Xunlei Thunder

Known/fameous malware:

Exploit:HTML/IESlice.BK.

This vulnerability was first reported on SEBUG.net. This vulnerability was used in mass SQL injection attack against Chinese websites in May 2008.