PT-2014-2086 · Openarena Team+2 · Openarena+2

Markus Koschany · Published 2014-10-27 · Updated 2014-10-29 · CVE-2010-5077

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions ioquake3 versions prior to r1762 OpenArena (affected versions not specified) Tremulous (affected versions not specified)

Description The issue allows remote attackers to cause a denial of service, specifically network traffic amplification, by sending spoofed requests. This can be achieved through either a getstatus or rcon request.

Recommendations For ioquake3 versions prior to r1762, update to version r1762 or later. For OpenArena, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Tremulous, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2010-5077

DSA-2442-1

Affected Products

Openarena

Tremulous

Ioquake3

References · 15

• https://osv.dev/vulnerability/CVE-2010-5077 · Vendor Advisory
• https://ubuntu.com/security/CVE-2010-5077 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2010-5077 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-5077 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2010-5077 · Vendor Advisory
• http://debian.org/security/2012/dsa-2442 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2010-5077 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-5077 · Vendor Advisory
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=665656 · Note
• http://urbanterror.info/forums/topic/27825-drdos · Note
• http://ioquake.org/forums/viewtopic.php?f=12&t=1694 · Note
• http://openarena.ws/board/index.php?topic=4391.0 · Note
• http://permalink.gmane.org/gmane.comp.games.ioquake3/961 · Note
• http://securityfocus.com/archive/1/522076 · Note
• http://openwall.com/lists/oss-security/2012/03/26/5 · Note