PT-2006-2616 · Doomsday · Doomsday Engine

Luigi Auriemma · Published 2006-04-05 · Updated 2018-10-18 · CVE-2006-1618

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Doomsday engine version 1.8.6

Description: The issue is related to a format string vulnerability in the Con message and conPrintf functions. This vulnerability allows remote attackers to execute arbitrary code via format string specifiers in an argument to the JOIN command, and possibly other command arguments.

Recommendations: For Doomsday engine version 1.8.6, consider disabling the JOIN command or restricting its use until a patch is available to prevent potential exploitation. Additionally, avoid using format string specifiers in command arguments to minimize the risk of arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-1618

Affected Products

Doomsday Engine

References · 12

• 🔥 http://aluigi.altervista.org/adv/doomsdayfs-adv.txt · Exploit
• 🔥 https://exploit-db.com/exploits/27566 · Exploit
• http://secunia.com/advisories/19515 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-1618 · Security Note
• http://gentoo.org/security/en/glsa/glsa-200604-05.xml · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25622 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-April/044865.html · Note
• http://secunia.com/advisories/19519 · Note
• http://securityfocus.com/bid/17369 · Note
• http://vupen.com/english/advisories/2006/1221 · Note
• http://securitytracker.com/id?1015860 · Note
• http://securityfocus.com/archive/1/429857/100/0/threaded · Note