PT-2006-2616 · Doomsday · Doomsday Engine

Luigi Auriemma · Publicado 2006-04-05 · Atualizado 2018-10-18 · CVE-2006-1618

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Doomsday engine version 1.8.6

Description: The issue is related to a format string vulnerability in the Con message and conPrintf functions. This vulnerability allows remote attackers to execute arbitrary code via format string specifiers in an argument to the JOIN command, and possibly other command arguments.

Recommendations: For Doomsday engine version 1.8.6, consider disabling the JOIN command or restricting its use until a patch is available to prevent potential exploitation. Additionally, avoid using format string specifiers in command arguments to minimize the risk of arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2006-1618

Produtos afetados

Doomsday Engine

Referências · 12

• 🔥 http://aluigi.altervista.org/adv/doomsdayfs-adv.txt · Exploit
• 🔥 https://exploit-db.com/exploits/27566 · Exploit
• http://secunia.com/advisories/19515 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25622 · Nota
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-April/044865.html · Nota
• http://secunia.com/advisories/19519 · Nota
• http://securityfocus.com/bid/17369 · Nota
• http://vupen.com/english/advisories/2006/1221 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-1618 · Nota de Segurança
• http://securitytracker.com/id?1015860 · Nota
• http://securityfocus.com/archive/1/429857/100/0/threaded · Nota
• http://gentoo.org/security/en/glsa/glsa-200604-05.xml · Aviso do Fabricante