PT-2007-5607 · Lfs · Live For Speed

Luigi Auriemma · Published 2007-08-20 · Updated 2018-10-15 · CVE-2007-4426

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Live for Speed (LFS) versions S1 and S2

Description The issue allows remote attackers to cause a denial of service, resulting in a server crash. This can be achieved through two methods: (1) sending a pre-login ID 3 packet containing a certain 0x00 byte, which triggers a NULL dereference, or (2) sending a pre-login ID 5 packet that lacks certain strings, triggering an invalid pointer dereference.

Recommendations For Live for Speed (LFS) versions S1 and S2, as a temporary workaround, consider restricting access to pre-login ID 3 and ID 5 packets until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-4426

Affected Products

Live For Speed

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2007-4426 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36020 · Note
• http://aluigi.altervista/adv/lfsbof-adv.txt · Note
• http://securityreason.com/securityalert/3030 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065265.html · Note
• http://secunia.com/advisories/26569 · Note
• http://vupen.com/english/advisories/2007/2975 · Note
• http://securityfocus.com/archive/1/476516/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36019 · Note