Max Gipehtykrop has discovered two vulnerabilities in BlooMooWeb's ActiveX control, which can be exploited by malicious people to compromise a user's system.

1) The "BW_DownloadFile()" method allows a web site to download a file from an arbitrary URL into an arbitrary location on a user's system.

2) The "BW_LaunchGame()" method allows a web site to run the main executable of BlooMooWeb.

Combining the use of these two insecure methods allows downloading and overwriting the main BlooMooWeb executable with a malicious file and then run it.

The vulnerability is confirmed in version 1.0.1.1. Other versions may also be affected.

Solution
Remove the files associated with the BlooMooWeb ActiveX control.

Provided and/or discovered by
Max Gipehtykrop, German Reverse Force.

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area