Description
Internet Download Manager 6.38.12 contains a buffer overflow vulnerability in the Scheduler component that allows local attackers to crash the application by supplying oversized input. Attackers can paste malicious data exceeding 5000 bytes into the 'Open the following file when done' field to trigger a denial of service condition.
Problem types
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Product status
Credits
Vincent Wolterman
References
www.exploit-db.com/exploits/49083 (ExploitDB-49083)
www.internetdownloadmanager.com/ (Official Product Homepage)
www.internetdownloadmanager.com/download.html (Product Reference)
www.vulncheck.com/...nload-manager-scheduler-buffer-overflow (VulnCheck Advisory: Internet Download Manager 6.38.12 Scheduler Buffer Overflow)