PT-2006-2291 · Ggz · Ggz Gaming Zone

Luigi Auriemma · Published 2006-03-19 · Updated 2017-07-20 · CVE-2006-1275

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions GGZ Gaming Zone version 0.0.12

Description The issue allows remote attackers to cause a denial of service, specifically a client disconnect, by providing malformed XML inputs. This can be achieved through several methods, including adding a trailing apostrophe character on the ID attribute in a PLAYER XML tag, joining with a long ID attribute or non-trailing apostrophe characters which results in a name being assigned and then disconnecting, or sending a long CDATA message attribute that prevents closing tags from being added to the string.

Recommendations For GGZ Gaming Zone version 0.0.12, as a temporary workaround, consider validating and sanitizing all XML inputs to prevent malformed data from being processed, and restrict the length of ID attributes and CDATA message attributes to prevent excessive data from being sent.

Exploit

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2006-1275

Affected Products

Ggz Gaming Zone

References · 8

• 🔥 http://securityfocus.com/bid/17094 · Exploit
• 🔥 https://exploit-db.com/exploits/27421 · Exploit
• 🔥 http://aluigi.altervista.org/adv/ggzcdos-adv.txt · Exploit
• http://vupen.com/english/advisories/2006/0935 · Vendor Advisory
• http://secunia.com/advisories/19212 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-1275 · Security Note
• http://osvdb.org/23848 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25164 · Note