A vulnerability has been discovered in Xunlei Thunder, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error in xplayer.dll_1_work and can be exploited to cause a heap-based buffer overflow by assigning an overly long (greater than 1060 bytes) string to the "FlvPlayerUrl" property of the PPlayer.XPPlayer.1 ActiveX control (pplayer.dll_1_work).

Successful exploitation allows execution of arbitrary code.

The vulnerability is confirmed in version 5.7.4.401. Other versions may also be affected.

Solution
Set the kill-bit for the affected ActiveX control.

Provided and/or discovered by
Discovered as a 0-day.

Changelog
Further details available to Secunia VIM customers

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers