----------------------------------------------------------------------

Want a new job?

http://secunia.com/secunia_security_specialist/
http://secunia.com/hardcore_disassembler_and_reverse_engineer/

----------------------------------------------------------------------

TITLE:
Ourgame GLWorld GLIEDown2.dll ActiveX Control Vulnerabilities

SECUNIA ADVISORY ID:
SA30469

VERIFY ADVISORY:
http://secunia.com/advisories/30469/

CRITICAL:
Extremely critical

IMPACT:
System access

WHERE:
>From remote

SOFTWARE:
Ourgame GLWorld 2.x
http://secunia.com/product/16420/

DESCRIPTION:
Multiple vulnerabilities have been discovered in the GLIEDown2.dll
ActiveX control bundled with Ourgame GLWorld, which can be exploited
by malicious people to compromise a user's system.

1) A boundary error when constructing file paths can be exploited to
cause a stack-based buffer overflow via either an overly long
argument passed to the "IEStart()" method or an overly long first or
second argument passed to the "IEStartNative()" method.

Successful exploitation allows execution of arbitrary code.

NOTE: Reportedly, this vulnerability is currently being actively
exploited.

2) An unspecified error exists during processing of values assigned
to the "ServerList" property. This can reportedly be exploited to
execute arbitrary code.

NOTE: Reportedly, this vulnerability is currently being actively
exploited.

3) Boundary errors in the handling of arguments passed to the
"IEStartNative()" method can be exploited to cause heap-based buffer
overflows via overly long arguments.

4) A boundary error when processing password strings can be exploited
to cause a stack-based buffer overflow via an overly long, specially
crafted string assigned to the "GameInfo" property.

Successful exploitation allows execution of arbitrary code.

5) A boundary error when handling values assigned to the "GameInfo"
property can be exploited to cause a heap-based buffer overflow via
an overly long string.

6) A boundary error when handling values assigned to the "GruopName"
property can be exploited to cause a heap-based buffer overflow via
an overly long string.

The vulnerabilities are confirmed in version 1.0.0.15 of the ActiveX
control as bundled with GLWorld 2.6.1.29. Vulnerability #4 is also
confirmed in version 1.0.0.18 of the ActiveX control as bundled with
GLWorld 2.8.1.2beta. Other versions may also be affected.

SOLUTION:
Apart from vulnerability #4 and reportedly also vulnerability #2, the
vulnerabilities are patched in version 1.0.0.18 of the ActiveX control
as bundled with GLWorld version 2.8.1.2beta.

Set the kill-bit for the affected ActiveX control.

PROVIDED AND/OR DISCOVERED BY:
Some vulnerabilities reported as 0-days.

Additional information provided by Secunia Research.

OTHER REFERENCES:
Symantec:
http://www.securityfocus.com/bid/29118
http://www.securityfocus.com/bid/29446

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------