PT-2006-4850 · Bomberclone · Bomberclone

Luigi Auriemma · Published 2006-08-07 · Updated 2017-07-20 · CVE-2006-4005

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions BomberClone versions 0.11.6 and earlier

Description The issue allows remote attackers to cause a denial of service, resulting in a daemon crash. This can be achieved through two methods: (1) sending a certain malformed PKGF ackreq packet, which triggers a crash in the rscache add() function in pkgcache.c; and (2) sending an error packet intended for clients, which instead also triggers server shutdown.

Recommendations For BomberClone versions 0.11.6 and earlier, as a temporary workaround, consider disabling the rscache add() function in pkgcache.c to prevent crashes from malformed PKGF ackreq packets. Additionally, restrict the handling of error packets to prevent unintended server shutdowns. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2006-4005

DSA-1180-1

Affected Products

Bomberclone

References · 15

• 🔥 http://securityfocus.com/bid/19255 · Exploit
• 🔥 http://aluigi.altervista.org/adv/bcloneboom-adv.txt · Exploit
• 🔥 http://aluigi.org/poc/bcloneboom.zip · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4005 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-4005 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2006-4005 · Vendor Advisory
• http://secunia.com/advisories/21303 · Vendor Advisory
• http://debian.org/security/2006/dsa-1180 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2006-4005 · Vendor Advisory
• http://osvdb.org/27647 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28090 · Note
• http://vupen.com/english/advisories/2006/3067 · Note
• http://osvdb.org/27649 · Note
• http://secunia.com/advisories/21985 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28093 · Note