Buffer overflow in Daum Communications Daumgame Activex Control
CVE-2013-7246
Buffer overflow in the IconCreate method in an ActiveX control in the DaumGame ActiveX plugin 1.1.0.4 and 1.1.0.5 allows remote attackers to execute arbitrary code via a long string, as exploited in the wild in January 2014.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v2 metric
CVSS v2 base score 9.3 (High). Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.112 (95.8th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 95.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.112 · newest: 0.112 · change: 0.000
Affected products
- Daum Communications Daumgame Activex Control — versions 1.1.0.4, 1.1.0.5
Weakness classification (CWE)
Public proof-of-concept exploits
References
- packetstormsecurity.com/files/124886 (Exploit)
- www.exploit-db.com/exploits/31179 (Exploit, exploit)
- exchange.xforce.ibmcloud.com/vulnerabilities/90588 (vdb-entry)
- blog.spiderlabs.com/2014/01/daumgame-activex-0day.html (Exploit)
- seclists.org/fulldisclosure/2014/Jan/132 (mailing-list)
- www.trustwave.com/spiderlabs/advisories/TWSL2014-002.txt (Exploit)
Frequently asked questions
- What is CVE-2013-7246?
- CVE-2013-7246 is a vulnerability in Daum Communications Daumgame Activex Control, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2014-01-30.
- Is CVE-2013-7246 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.