CVE-2009-20008

published 2025-08-30

CVE-2009-20008: Green Dam Youth Escort version 3.17 is vulnerable to a stack-based buffer overflow when processing overly long URLs. The flaw resides in the URL filtering…

Priority P2 61 high 8.6 CVSS 4.0

AV N AC L AT N PR N UI A VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

EXPLOIT

Green Dam Youth Escort version 3.17 is vulnerable to a stack-based buffer overflow when processing overly long URLs. The flaw resides in the URL filtering component, which fails to properly validate input length before copying user-supplied data into a fixed-size buffer. A remote attacker can exploit this vulnerability by enticing a user to visit a specially crafted webpage containing a long URL, resulting in arbitrary code execution.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
zhengzhou_jinhui_computer_system_engineering_co_ltd_beijing_dazheng_human_langua	green_dam_youth_escort	—	—

Detection & IOCs extracted from sources · hover to see the quote

version Green Dam Youth Escort 3.17↗

url https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/greendam_url.rb↗

• → Monitor for browser processes spawning child processes or shellcode execution following navigation to pages with abnormally long URLs, which may indicate exploitation of the Green Dam URL filtering component. ↗
• → Detect use of .NET DLL memory technique (Sotirov/Dowd) in browser exploit context, which is used by the known exploit module to bypass DEP, NX, and ASLR. ↗
• → Alert on excessively long URLs (beyond normal bounds) being processed by the Green Dam Youth Escort URL filtering component on Windows hosts. ↗

• · The exploit is browser-based and requires user interaction; exploitation depends on the victim visiting a specially crafted webpage, limiting automated/wormable attack surface. ↗
• · The known Metasploit module is designed to bypass DEP, NX, and ASLR via the .NET DLL memory technique, meaning standard memory-protection mitigations alone are insufficient to block exploitation. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-121