PT-2007-2672 · Netrek · Netrek Vanilla Server

Published 2007-03-03 · Updated 2018-10-16 · CVE-2007-1251

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Netrek Vanilla Server version 2.12.0

Description The issue is related to a format string vulnerability in the new warning function. This vulnerability can be exploited by remote attackers to cause a denial of service or execute arbitrary code via format string specifiers in the message handling when EVENTLOG is enabled.

Recommendations For Netrek Vanilla Server version 2.12.0, consider disabling the EVENTLOG feature to minimize the risk of exploitation until a patch is available. Restrict access to the new warning function in ntserv/warning.c to prevent potential attacks.

Exploit

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2007-1251

Affected Products

Netrek Vanilla Server

References · 9

• 🔥 http://aluigi.altervista.org/adv/netrekfs-adv.txt · Exploit
• 🔥 https://exploit-db.com/exploits/3399 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1251 · Security Note
• http://secunia.com/advisories/24357 · Vendor Advisory
• http://sourceforge.net/project/shownotes.php?release_id=490561 · Note
• http://securityfocus.com/archive/1/461755/100/0/threaded · Note
• http://securityfocus.com/bid/22786 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32777 · Note
• http://vupen.com/english/advisories/2007/0815 · Note