PT-2006-7557 · Crossfire · Crossfire

Luigi Auriemma · Published 1970-01-01 · Updated 2021-08-18 · CVE-2006-1010

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions CrossFire versions prior to 1.9.0

Description The issue is related to multiple vulnerabilities in the CrossFire package, which can lead to disruption of integrity and availability of protected information. These vulnerabilities can be exploited remotely, potentially causing a denial of service or allowing remote attackers to execute code by sending a large request to the server.

Recommendations For versions prior to 1.9.0, update to version 1.9.0 or later to resolve the issue. As a temporary workaround, consider disabling the oldsocketmode feature until a patch is available. Restrict access to the socket/request.c module to minimize the risk of exploitation. Avoid using large requests in the affected API endpoint until the issue is resolved.

Exploit

Fix

Related Identifiers

BDU:2015-02866

BDU:2015-02867

BDU:2015-02868

CVE-2006-1010

DSA-1001-1

Affected Products

Crossfire

References · 22

• 🔥 http://secunia.com/advisories/19044 · Exploit
• 🔥 http://aluigi.altervista.org/poc/crossfirebof.zip · Exploit
• 🔥 https://exploit-db.com/exploits/1535 · Exploit
• https://bdu.fstec.ru/vul/2015-02866 · Security Note
• http://debian.org/security/2006/dsa-1001 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200604-11.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-1010 · Security Note
• https://bdu.fstec.ru/vul/2015-02868 · Security Note
• http://cvs.sourceforge.net/viewcvs.py/crossfire/crossfire/socket/request.c?r1=1.80&r2=1.81 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-1010 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02867 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1010 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2006-1010 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2006-1010 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24932 · Note