PT-2006-2291 · Ggz · Ggz Gaming Zone

Luigi Auriemma · Publicado 2006-03-19 · Atualizado 2017-07-20 · CVE-2006-1275

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions GGZ Gaming Zone version 0.0.12

Description The issue allows remote attackers to cause a denial of service, specifically a client disconnect, by providing malformed XML inputs. This can be achieved through several methods, including adding a trailing apostrophe character on the ID attribute in a PLAYER XML tag, joining with a long ID attribute or non-trailing apostrophe characters which results in a name being assigned and then disconnecting, or sending a long CDATA message attribute that prevents closing tags from being added to the string.

Recommendations For GGZ Gaming Zone version 0.0.12, as a temporary workaround, consider validating and sanitizing all XML inputs to prevent malformed data from being processed, and restrict the length of ID attributes and CDATA message attributes to prevent excessive data from being sent.

Exploit

Correção

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2006-1275

Produtos afetados

Ggz Gaming Zone

Referências · 8

• 🔥 http://securityfocus.com/bid/17094 · Exploit
• 🔥 https://exploit-db.com/exploits/27421 · Exploit
• 🔥 http://aluigi.altervista.org/adv/ggzcdos-adv.txt · Exploit
• http://vupen.com/english/advisories/2006/0935 · Aviso do Fabricante
• http://secunia.com/advisories/19212 · Aviso do Fabricante
• http://osvdb.org/23848 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-1275 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25164 · Nota