cbcvebase.
CVE-2013-7246
published 2014-01-30

CVE-2013-7246: Buffer overflow in the IconCreate method in an ActiveX control in the DaumGame ActiveX plugin 1.1.0.4 and 1.1.0.5 allows remote attackers to execute arbitrary…

PriorityP269critical9.3CVSS 2.0
AVNACMAuNCCICAC
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
11.25%
95.4th percentile
Buffer overflow in the IconCreate method in an ActiveX control in the DaumGame ActiveX plugin 1.1.0.4 and 1.1.0.5 allows remote attackers to execute arbitrary code via a long string, as exploited in the wild in January 2014.

Affected

2 ranges
VendorProductVersion rangeFixed in
daum_communicationsdaumgame_activex_control——
daum_communicationsdaumgame_activex_control——

Detection & IOCsextracted from sources · hover to see the quote

versionDaumGame ActiveX plugin 1.1.0.4 / 1.1.0.5↗
bytes↗
%05%05%05%05... (repeated 0x05 bytes used as stack overflow padding/overwrite pattern)
bytes↗
%90%90%eb%06%a9%15%6c%74%90%90%90%90%90%90%90%90%90%90%90%90 (NOP sled + shellcode stub)
  • →Detect invocation of the IconCreate method on the DaumGame ActiveX control with an abnormally long string argument (stack buffer overflow trigger). ↗
  • →Look for the NOP sled + short-jump shellcode stub bytes 0x90 0x90 0xEB 0x06 0xA9 0x15 0x6C 0x74 followed by NOP padding in memory or network content associated with the exploit. ↗
  • →Detect large blocks of repeated 0x05 bytes (URL-encoded as %05) passed as a JavaScript string to an ActiveX method, characteristic of this exploit's overwrite buffer. ↗
  • →This vulnerability was exploited in the wild in January 2014; prioritize hunting in web proxy/IDS logs from that period for pages instantiating the DaumGame ActiveX control. ↗
  • ·The exploit targets only DaumGame ActiveX plugin versions 1.1.0.4 and 1.1.0.5; other versions are not confirmed vulnerable. ↗

CVSS provenance

nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck9.3CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.