PT-2006-4285 · Papyrus · Papyrus Nascar Racing 2002 Season+2

Luigi Auriemma · Publicado 2006-07-06 · Atualizado 2017-07-20 · CVE-2006-3393

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Papyrus NASCAR Racing 4 versions 4.1.3.1.6 and earlier Papyrus NASCAR Racing 2002 Season version 1.1.0.2 and earlier Papyrus NASCAR Racing 2003 Season version 1.2.0.1 and earlier

Description The issue allows remote attackers to cause a denial of service by consuming CPU resources. This is achieved by sending an empty UDP datagram, which is not properly handled due to the use of the FIONREAD asynchronous socket.

Recommendations For Papyrus NASCAR Racing 4 versions 4.1.3.1.6 and earlier, consider restricting access to the UDP endpoint to minimize the risk of exploitation. For Papyrus NASCAR Racing 2002 Season version 1.1.0.2 and earlier, avoid using the FIONREAD asynchronous socket until the issue is resolved. For Papyrus NASCAR Racing 2003 Season version 1.2.0.1 and earlier, as a temporary workaround, consider disabling the reception of empty UDP datagrams until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2006-3393

Produtos afetados

Papyrus Nascar Racing 2002 Season

Papyrus Nascar Racing 2003 Season

Papyrus Nascar Racing 4

Referências · 6

• 🔥 http://aluigi.altervista.org/adv/nascarzero-adv.txt · Exploit
• http://vupen.com/english/advisories/2006/2647 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3393 · Nota de Segurança
• http://secunia.com/advisories/20947 · Aviso do Fabricante
• http://securityfocus.com/bid/18778 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27522 · Nota