Secunia

Multiple vulnerabilities have been discovered in the GLIEDown2.dll ActiveX control bundled with Ourgame GLWorld, which can be exploited by malicious people to compromise a user's system.

1) A boundary error when constructing file paths can be exploited to cause a stack-based buffer overflow via either an overly long argument passed to the "IEStart()" method or an overly long first or second argument passed to the "IEStartNative()" method.

Successful exploitation allows execution of arbitrary code.

NOTE: Reportedly, this vulnerability is currently being actively exploited.

2) An unspecified error exists during processing of values assigned to the "ServerList" property. This can reportedly be exploited to execute arbitrary code.

NOTE: Reportedly, this vulnerability is currently being actively exploited.

3) Boundary errors in the handling of arguments passed to the "IEStartNative()" method can be exploited to cause heap-based buffer overflows via overly long arguments.

4) A boundary error when processing password strings can be exploited to cause a stack-based buffer overflow via an overly long, specially crafted string assigned to the "GameInfo" property.

Successful exploitation allows execution of arbitrary code.

5) A boundary error when processing quoted password strings can be exploited to cause a stack-based buffer overflow via an overly long, specially crafted string assigned to the "GameInfo" property.

Successful exploitation allows execution of arbitrary code.

6) A boundary error when processing password strings containing numeric characters can be exploited to cause a stack-based buffer overflow via an overly long, specially crafted string assigned to the "GameInfo" property.

Successful exploitation allows execution of arbitrary code.

7) A boundary error when handling values assigned to the "GameInfo" property can be exploited to cause a heap-based buffer overflow via an overly long string.

8) A boundary error when handling values assigned to the "GruopName" property can be exploited to cause a heap-based buffer overflow via an overly long string.

The vulnerabilities are confirmed in version 1.0.0.15 of the ActiveX control as bundled with GLWorld 2.6.1.29. Vulnerability #4 is also confirmed in version 1.0.0.18 of the ActiveX control as bundled with GLWorld 2.8.1.2beta. Other versions may also be affected.

Solution
Apart from vulnerabilities #4, #5, and #6 and reportedly also vulnerability #2, the vulnerabilities are patched in version 1.0.0.18 of the ActiveX control as bundled with GLWorld version 2.8.1.2beta.
Further details available in Customer Area

Provided and/or discovered by
Some vulnerabilities reported as 0-days.

Additional information provided by Secunia Research.

Changelog
Further details available in Customer Area

Other references
Further details available in Customer Area

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area