Description
Multiple stack-based buffer overflows in CyberLink Power2Go 7 (build 196) and 8 (build 1031) allow remote attackers to execute arbitrary code via the (1) src and (2) name parameters in a p2g project file.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
CyberLink Power2Go name Attribute (p2g) Stack Buffer Overflow Exploit
exploit/windows/fileformat/cyberlink_p2g_bof
Exploit-DB 2
- CyberLink Power2Go - name Attribute (p2g) Stack Buffer Overflow (Metasploit) EDB-18747 · local · Apr 18, 2012 · verified
- CyberLink (Multiple Products) - File Project Handling Stack Buffer Overflow (PoC) EDB-18220 · dos · Dec 9, 2011 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 18220 exploit
- power2go-p2g-bo(71723) vdb-entry
- 77600 vdb-entry
- VU#158003 third-party-advisory
- 47145 third-party-advisory