PT-2006-3484 · Openbor Team+1 · Openbor+2

Luigi Auriemma · Published 2006-05-22 · Updated 2017-07-20 · CVE-2006-2537

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenBOR versions 2.0046 and earlier Beats of Rage (BOR) versions 1.0029 and earlier Horizontal Shooter BOR (HOR) versions 2.0000 and earlier

Description The issue allows remote attackers to execute code via format string specifiers in configurations used in various mod files. This is demonstrated by the music identifier in "data/scenes/intro.txt", which is not properly handled in the update function, and the background identifier in "data/easy/1aeasy.txt", which is not properly handled in the shutdown function.

Recommendations For OpenBOR versions 2.0046 and earlier, update to a version that properly handles format string specifiers in configurations. For Beats of Rage (BOR) versions 1.0029 and earlier, update to a version that properly handles format string specifiers in configurations. For Horizontal Shooter BOR (HOR) versions 2.0000 and earlier, update to a version that properly handles format string specifiers in configurations.

Exploit

Fix

Related Identifiers

CVE-2006-2537

Affected Products

Beats Of Rage

Horizontal Shooter Bor

Openbor

References · 11

• 🔥 http://aluigi.altervista.org/adv/borfs-adv.txt · Exploit
• http://secunia.com/advisories/20173 · Vendor Advisory
• http://secunia.com/advisories/20174 · Vendor Advisory
• http://secunia.com/advisories/20181 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-2537 · Security Note
• http://vupen.com/english/advisories/2006/1902 · Note
• http://osvdb.org/25687 · Note
• http://vupen.com/english/advisories/2006/1903 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26582 · Note
• http://vupen.com/english/advisories/2006/1901 · Note
• http://securityfocus.com/bid/18088 · Note