CVE-2010-5077: Input Validation
First published: Sun Mar 25 2012(Updated: )
server/sv_main.c in Quake3 Arena, as used in ioquake3 before r1762, OpenArena, Tremulous, and other products, allows remote attackers to cause a denial of service (network traffic amplification) via a spoofed (1) getstatus or (2) rcon request.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/ioquake3 | 1.36+u20181222.e5da13f~dfsg-2 1.36+u20201117.d1b7ab6~dfsg-1 1.36+u20221123.70d07d9+dfsg-1 1.36+u20230706.10a45cb+dfsg-1 1.36+u20230819.b1e6ef1+dfsg-1 | |
| debian/openarena | 0.8.8+dfsg-2 0.8.8+dfsg-5 0.8.8+dfsg-6 0.8.8+dfsg-7 | |
| Tremulous | ||
| npm | ||
| ioQuake3 | <=r1761 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.debian.org/security/2012/dsa-2442
- http://www.securityfocus.com/archive/1/522076
- http://www.ioquake.org/forums/viewtopic.php?f=12&t=1694
- http://www.openwall.com/lists/oss-security/2012/03/26/5
- http://permalink.gmane.org/gmane.comp.games.ioquake3/961
- http://openarena.ws/board/index.php?topic=4391.0
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=665656
- http://www.urbanterror.info/forums/topic/27825-drdos/
- http://lists.ioquake.org/pipermail/ioquake3-ioquake.org/2012-January/004778.html
- http://icculus.org/pipermail/quake3-commits/2010-January/001679.html
- http://www.altfire.com/main/news/index.php?news_id=586
- http://alioth.debian.org/~smcv/
- http://anonscm.debian.org/gitweb/?p=pkg-games/openarena.git;a=commitdiff;h=caeb284533211bb0f76872279106a49306290168
- http://alioth.debian.org/~smcv/openarena_0.8.5-5+squeeze2~try1_i386.changes
- http://alioth.debian.org/~smcv/openarena_0.8.5-5+squeeze2~try1_amd64.changes
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=665656
- http://ioquake3.org/
- https://security-tracker.debian.org/tracker/CVE-2010-5077
- collector/debian-bugs
- alias/CVE-2010-5077
- collector/security-tracker-debian
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/author
- agent/severity
- agent/weakness
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/debian
- vendor/tremulous
- canonical/tremulous
- vendor/openarena
- canonical/npm
- vendor/ioquake3
- canonical/ioquake3
- version/ioquake3/r1761