PT-2009-3026 · Battle For Wesnoth · Wesnoth

Daniel Franke · Published 2009-03-12 · Updated 2009-03-21 · CVE-2009-0366

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Wesnoth versions prior to r33069

Description The issue allows remote attackers to cause a denial of service via a large compressed WML document. This is due to a problem in the uncompress buffer function in src/server/simple wml.cpp.

Recommendations For versions prior to r33069, update to a version after r33069 to resolve the issue. As a temporary workaround, consider restricting the size of compressed WML documents to prevent denial of service attacks.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2009-0366

DSA-1737-1

Affected Products

Wesnoth

References · 14

• http://debian.org/security/2009/dsa-1737 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0366 · Security Note
• http://secunia.com/advisories/34253 · Note
• http://launchpad.net/bugs/335089 · Note
• https://gna.org/bugs/index.php?13037 · Note
• http://svn.gna.org/viewcvs/wesnoth/trunk/src/server/simple_wml.cpp?rev=33069&r1=32990&r2=33069 · Note
• http://securityfocus.com/bid/34085 · Note
• http://launchpad.net/bugs/cve/2009-0366 · Note
• http://osvdb.org/52672 · Note
• http://svn.gna.org/viewcvs/wesnoth/trunk/src/server/simple_wml.cpp?rev=33069&view=log · Note
• http://secunia.com/advisories/34236 · Note
• http://packages.debian.org/changelogs/pool/main/w/wesnoth/wesnoth_1.5.12-1/changelog · Note
• http://packages.debian.org/changelogs/pool/main/w/wesnoth/wesnoth_1.4.7-4/changelog · Note
• http://launchpad.net/bugs/336396 · Note