CVE-2006-1010: Buffer Overflow

Published Mar 6, 2006

Updated

Buffer overflow in socket/request.c in CrossFire before 1.9.0, when oldsocketmode is enabled, allows remote attackers to cause a denial of service (segmentation fault) and possibly execute code by sending the server a large request.

Affected Software

2 affected components

CrossFire CrossFire=1.7.0

CrossFire CrossFire=1.8.0

Remediation

Patch Available

http://cvs.sourceforge.net/viewcvs.py/crossfire/crossfire/socket/request.c?r1=1.80&r2=1.81

Patch Available

http://secunia.com/advisories/19044

Event History

Mar 6, 2006

CVE Published

09:02 PM

Mar 7, 2006

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

Which deployments are exposed to this issue?

CrossFire servers before 1.9.0 are affected only when oldsocketmode is enabled. The flaw is remotely reachable over the network.

What does an attacker need to exploit it?

An attacker does not need authentication and can trigger the issue by sending a large request to the server. Successful exploitation can cause a segmentation fault and may allow code execution.

What should operators do if they cannot patch immediately?

Disable oldsocketmode where possible, since the vulnerable condition requires it to be enabled. Apply the available patch or upgrade to a version that includes the fix as soon as possible.

CVE-2006-1010: Buffer Overflow

Affected Software

Remediation

Patch Available

Patch Available

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What should operators do if they cannot patch immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What should operators do if they cannot patch immediately?