PT-2006-4285 · Papyrus · Papyrus Nascar Racing 2002 Season+2

Luigi Auriemma · Published 2006-07-06 · Updated 2017-07-20 · CVE-2006-3393

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Papyrus NASCAR Racing 4 versions 4.1.3.1.6 and earlier Papyrus NASCAR Racing 2002 Season version 1.1.0.2 and earlier Papyrus NASCAR Racing 2003 Season version 1.2.0.1 and earlier

Description The issue allows remote attackers to cause a denial of service by consuming CPU resources. This is achieved by sending an empty UDP datagram, which is not properly handled due to the use of the FIONREAD asynchronous socket.

Recommendations For Papyrus NASCAR Racing 4 versions 4.1.3.1.6 and earlier, consider restricting access to the UDP endpoint to minimize the risk of exploitation. For Papyrus NASCAR Racing 2002 Season version 1.1.0.2 and earlier, avoid using the FIONREAD asynchronous socket until the issue is resolved. For Papyrus NASCAR Racing 2003 Season version 1.2.0.1 and earlier, as a temporary workaround, consider disabling the reception of empty UDP datagrams until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-3393

Affected Products

Papyrus Nascar Racing 2002 Season

Papyrus Nascar Racing 2003 Season

Papyrus Nascar Racing 4

References · 6

• 🔥 http://aluigi.altervista.org/adv/nascarzero-adv.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-3393 · Security Note
• http://secunia.com/advisories/20947 · Vendor Advisory
• http://vupen.com/english/advisories/2006/2647 · Note
• http://securityfocus.com/bid/18778 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27522 · Note