PT-2007-6330 · Monolith · Monolith Lithtech Engine

Publicado 2007-10-06 · Atualizado 2018-10-15 · CVE-2007-5247

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Monolith Lithtech engine versions 1.08 and earlier

Description: The issue concerns multiple format string vulnerabilities in the Monolith Lithtech engine. These vulnerabilities can be exploited by remote attackers to execute arbitrary code or cause a denial of service, resulting in a daemon crash. The exploitation can occur through format string specifiers in specific packets, including a PB Y packet to the YPG server on UDP port 27888 or a PB U packet to UCON on UDP port 27888.

Recommendations: For Monolith Lithtech engine versions 1.08 and earlier, consider disabling Punkbuster (PB) until a patch is available to prevent exploitation. Additionally, restrict access to the YPG server on UDP port 27888 and UCON on UDP port 27888 to minimize the risk of exploitation.

Exploit

Correção

Use of Externally-Controlled Format String

Enumeração de Fraquezas

CWE-134

Identificadores relacionados

CVE-2007-5247

Produtos afetados

Monolith Lithtech Engine

Referências · 8

• 🔥 http://aluigi.org/poc/fearfspb.zip · Exploit
• 🔥 http://aluigi.altervista.org/adv/fearfspb-adv.txt · Exploit
• http://osvdb.org/45530 · Nota
• http://securityfocus.com/archive/1/481231/100/0/threaded · Nota
• http://osvdb.org/45531 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36900 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5247 · Nota de Segurança
• http://securityreason.com/securityalert/3197 · Nota