cbcvebase.
CVE-2009-1800
published 2009-05-28

CVE-2009-1800: Stack-based buffer overflow in the Chinagames CGAgent ActiveX control 1.x in CGAgent.dll, as distributed in Chinagames iGame 2009, allows remote attackers to…

PriorityP263high7.5CVSS 2.0
AVNACLAuNCPIPAP
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
10.90%
95.3th percentile
Stack-based buffer overflow in the Chinagames CGAgent ActiveX control 1.x in CGAgent.dll, as distributed in Chinagames iGame 2009, allows remote attackers to execute arbitrary code via a long argument to the CreateChinagames method, as exploited in the wild in April and May 2009. NOTE: some of these details are obtained from third party information.

Affected

1 ranges
VendorProductVersion rangeFixed in
chinagamesigame——

Detection & IOCsextracted from sources · hover to see the quote

filenameCGAgent.dll↗
commandCreateChinagames(param1)↗
bytes↗
\u68fc\u0a6a\u1e38\u6368\ud189\u684f\u7432\u0c91\uf48b\u7e8d\u33f4\ub7db\u2b04\u66e3\u33bb\u5332\u7568\u6573\u5472\ud233\u8b64\u305a\u4b8b\u8b0c\u1c49\u098b\u698b\uad08\u6a3d\u380a\u751e\u9505\u57ff\u95f8\u8b60\u3c45\u4c8b\u7805\ucd03\u598b\u0320\u33dd\u47ff\u348b\u03bb\u99f5\ube0f\u3a06\u74c4\uc108\u07ca\ud003\ueb46\u3bf1\u2454\u751c\u8be4\u2459\udd03\u8b66\u7b3c\u598b\u031c\u03dd\ubb2c\u5f95\u57ab\u3d61\u0a6a\u1e38\ua975\udb33\u6853\u6574\u7473\uc48b\u6853\u3a20\u292d\u7468\u2065\u6820\u6168\u6972\ud48b\u5053\u5352\u57ff\u53fc\u57ff\u00f8
  • →Monitor for ActiveX instantiation of CGAgent.dll (CLSID lookup) in browser processes, particularly calls to the CreateChinagames method with an abnormally long first argument — this is the direct trigger for the stack-based buffer overflow. ↗
  • →Detect heap-spray NOP sled pattern (%u9090%u9090) combined with unescape() calls in JavaScript, which is used in the in-the-wild exploit to reliably land execution in the shellcode. ↗
  • →The exploit was actively used in the wild during April and May 2009; prioritise retrospective log review for web proxy/IDS hits against pages loading CGAgent.dll ActiveX during that window. ↗
  • ·The vulnerable component is version 1.x of the CGAgent ActiveX control distributed with Chinagames iGame 2009; only hosts with this specific version of CGAgent.dll loaded in a browser are exploitable. ↗

CVSS provenance

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.