Loading vulnerability…
CVE-2014-2206 is a stack-based buffer overflow in GetGo Download Manager 4.9.0.1982, 4.8.2.1346, 4.4.5.502, and potentially earlier versions. While processing an HTTP response for a download, the application copies response-header data into a fixed 4,097-byte stack buffer. The parsing loop continues copying one byte at a time until it finds a CRLF terminator without enforcing the buffer boundary. An oversized attacker-controlled HTTP response header therefore overflows the stack buffer and can overwrite exception-handler or return-control data.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a single Metasploit module (Ruby file) that exploits a stack-based buffer overflow vulnerability (CVE-2014-2206) in GetGo Download Manager versions 5.3.0.2712 and earlier. The exploit works by running a malicious HTTP server that serves a specially crafted response with an overly long header, triggering the buffer overflow when the victim downloads a file using the vulnerable application. The module supports multiple target versions and automatically selects the appropriate exploit method based on the User-Agent string or target selection. The payload is user-selectable and is delivered as part of the overflow, allowing for arbitrary code execution on the victim's Windows XP SP3 system. The only fingerprintable endpoint is the default URIPATH '/shakeitoff.mp3', which is used to lure the victim into triggering the exploit. The code is operational and leverages Metasploit's payload and HTTP server infrastructure.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Critical stack-based buffer overflow in GetGo Download Manager that enables a remote attacker controlling an HTTP response header larger than 4097 bytes to overwrite SEH or return control data, potentially achieving arbitrary code execution in the context of the application user. Failed exploitation causes denial of service.
A critical stack-based buffer overflow in GetGo Download Manager’s HTTP response header parsing logic. The program allocates/clears a fixed 4097-byte stack buffer but does not enforce that limit while reading header bytes until a CRLF terminator is found, enabling remote code execution via an oversized HTTP response header.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.