Exploit:HTML/IESlice.BK

Classification

Category:Malware

Type:Exploit

Platform:JS

Aliases:

Exploit:HTML/IESlice.BK

Summary

Exploit:HTML/IESlice.BK exploits a vulnerability in an ActiveX control used by Xunlei Thunder 5.7.4.401.

Malicious or compromised websites use the exploit to download and execute arbitrary code.

Removal

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.

Technical Details

Exploit:HTML/IESlice.BK is a script that exploits a heap-based buffer overflow in the PPlayer.XPPlayer.1 ActiveX control used by the pplayer.dll_1_work DLL of Xunlei Thunder 5.7.4.401.

Sucessful exploitation allows the attacker to download and execute arbitrary code on the victim's computer.

Exploitation is done via a malicious webpage containing the detected script.

This vulnerability is under review as CVE-2007-6144.

Exploit:HTML/IESlice.BK will attempt to download a file from the following URL and execute it: