Secunia

Luigi Auriemma has reported two vulnerabilities in X-Doom, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system.

1) A boundary error in the checking of client maps (.wad files) when a client connects can be exploited to cause a buffer overflow by passing an overly long string (more than 256 bytes) as the filename of a map.

Successful exploitation requires knowledge of the password if the server is password protected.

2) Out-of-bounds memory access errors in the "ZD_MissingPlayer()", "ZD_UseItem()", and "ZD_ValidClient()" functions can be exploited to crash the server by supplying an invalid value.

Successful exploitation requires access to a match on a vulnerable server.

The vulnerabilities have been reported in Release VI (1.06.07). Other versions may also be affected.

Solution

Provided and/or discovered by
Luigi Auriemma

Changelog
Further details available in Customer Area

Original Advisory
http://aluigi.altervista.org/adv/zdaebof-adv.txt

Deep Links
Links available in Customer Area