As aresult, clients receiving the content may behave unpredictably in manycases, causing browser crashes.

However, on closer inspection we havealso found that the server appears to be misconfigured, as a result theclient detection and exploit selection code is appended to everythingthat the server serves up–HTML, data, and binary files included. Baidu Soba Search Bar BaiduBar.DLL ActiveX Control Remote Code Execution VulnerabilityĬlearly this piece of malware attempts to cover its bases prettywell in terms of market coverage.Yahoo! Webcam ActiveX Control Buffer Overrun Vulnerability.Upon further analysis we have discovered that the following vulnerabilities are also used on this Web server: Until a vendor patch is available, users can minimize their risk ofexposure by avoiding unknown or untrusted URLs, such as those sent inspam emails and unsolicited instant messages, disabling JavaScript andActiveX in their Web browser and ensuring that their antivirus softwareis up-to-date. These files are currently detected by Symantec as Downloader and Trojan.Maliframe!html. Successful exploitation of the client results in code execution thatmay result in the download and installation of additional maliciousfiles. Microsoft Windows Cursor And Icon ANI Format Handling Remote Buffer Overflow Vulnerability.Microsoft Windows Vector Markup Language Buffer Overrun Vulnerability.Xunlei Web Thunder ActiveX Control DownURL2 Method Remote Buffer Overflow Vulnerability.PPStream PowerPlayer.DLL ActiveX Control Buffer Overflow Vulnerability.BaoFeng Storm MPS.DLL ActiveX Control Multiple Remote Buffer Overflow Vulnerabilities.SSReader Ultra Star Reader ActiveX Control Register Method Buffer Overflow Vulnerability.Microsoft MDAC RDS.Dataspace ActiveX Control Remote Code Execution Vulnerability.Xunlei Thunder PPLAYER.DLL_1_WORK ActiveX Control Buffer Overflow Vulnerability.We have seen a whole range ofvulnerabilities both new and old used by this site, including thefollowing: This technique is similar to the techniquesused by the MPackattack kit that is already widely used.

If auser navigates to the site, a Web page hosted on the site employs aclient detection technique to determine the appropriate exploit codethat should be sent back to the requesting client in order tosuccessfully exploit it. The attack originates from a server on the 522love.cn domain. This is a component ofthe Chinese download accelerator and file-sharing application, XunleiThunder 5.7.4 401. Symantec Security Response has observed web based exploit attacks using a previously unknown vulnerabilityin the Xunlei Thunder PPlayer ActiveX control.

Xunlei thunder download