CVE-2013-7246

2014-01-3018:55:03

CWE-119

mitre

web.nvd.nist.gov

111

cve-2013-7246

buffer overflow

daumgame activex

remote code execution

nvd

iconcreate method

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.9

Confidence

Low

EPSS

0.27

Percentile

96.8%

JSON

Buffer overflow in the IconCreate method in an ActiveX control in the DaumGame ActiveX plugin 1.1.0.4 and 1.1.0.5 allows remote attackers to execute arbitrary code via a long string, as exploited in the wild in January 2014.

Affected configurations

Nvd

Node

daum_communicationsdaumgame_activex_controlMatch1.1.0.4

daum_communicationsdaumgame_activex_controlMatch1.1.0.5

VendorProductVersionCPE
daum_communicationsdaumgame_activex_control1.1.0.4cpe:2.3:a:daum_communications:daumgame_activex_control:1.1.0.4:*:*:*:*:*:*:*
daum_communicationsdaumgame_activex_control1.1.0.5cpe:2.3:a:daum_communications:daumgame_activex_control:1.1.0.5:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
daum_communications	daumgame_activex_control	1.1.0.4	cpe:2.3:a:daum_communications:daumgame_activex_control:1.1.0.4:::::::*
daum_communications	daumgame_activex_control	1.1.0.5	cpe:2.3:a:daum_communications:daumgame_activex_control:1.1.0.5:::::::*