PT-2006-4649 · Ufo2000 · Ufo2000

Luigi Auriemma · Publicado 2006-07-21 · Atualizado 2018-10-17 · CVE-2006-3789

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions UFO2000 version prior to svn 1058

Description The issue is related to multiple array index errors in certain functions within the multiplay.cpp file. Specifically, the errors occur in the recv rules, recv select unit, recv options, and recv unit data functions. These errors can be exploited by remote attackers to execute arbitrary code and cause a denial of service, resulting in an opponent crash. This can be achieved by sending certain packet data that specifies an out-of-bounds index.

Recommendations For UFO2000 version prior to svn 1058, update to a version later than svn 1057 to resolve the issue. As a temporary workaround, consider restricting access to the multiplay functionality until a patch is available.

Correção

Identificadores relacionados

CVE-2006-3789

Produtos afetados

Ufo2000

Referências · 12

• http://gentoo.org/security/en/glsa/glsa-200702-10.xml · Aviso do Fabricante
• http://secunia.com/advisories/24297 · Nota
• http://svn.sourceforge.net/viewcvs.cgi/ufo2000/trunk/src/multiplay.cpp?view=log · Nota
• http://securityreason.com/securityalert/1259 · Nota
• http://vupen.com/english/advisories/2006/2837 · Nota
• http://securitytracker.com/id?1016503 · Nota
• http://securityfocus.com/archive/1/440293/100/0/threaded · Nota
• http://secunia.com/advisories/21091 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-3789 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27802 · Nota
• http://aluigi.altervista.org/adv/ufo2ko-adv.txt · Nota
• http://securityfocus.com/bid/19035 · Nota