PT-2009-2174 · Gsc Game World · S.T.A.L.K.E.R.: Shadow Of Chernobyl

Published 2009-04-10 · Updated 2017-08-17 · CVE-2008-6705

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions S.T.A.L.K.E.R.: Shadow of Chernobyl versions 1.0006 and earlier

Description The issue allows remote attackers to cause a denial of service, resulting in server termination. This is achieved by sending a crafted packet that lacks an expected 0xe0 or 0xe1 value, triggering the INT3 instruction in the MultipacketReciever::RecievePacket function.

Recommendations For S.T.A.L.K.E.R.: Shadow of Chernobyl versions 1.0006 and earlier, as a temporary workaround, consider disabling the MultipacketReciever::RecievePacket function until a patch is available. Restrict access to the vulnerable function to minimize the risk of exploitation. Avoid using crafted packets that could trigger the INT3 instruction in the affected function until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2008-6705

Affected Products

S.T.A.L.K.E.R.: Shadow Of Chernobyl

References · 7

• 🔥 http://securityfocus.com/archive/1/493765 · Exploit
• http://secunia.com/advisories/30891 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-6705 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43458 · Note
• http://aluigi.altervista.org/adv/stalker39x-adv.txt · Note
• http://securityfocus.com/bid/29997 · Note
• http://osvdb.org/46628 · Note