A vulnerability has been reported in Netrek Vanilla Server, which potentially can be exploited by malicious people to cause a DoS (Denial of Service) or compromise a vulnerable system.

The vulnerability is caused due to a format string error within the "new_warning()" function in ntserv/warning.c when invoking the "pmessage2()" function. This can be exploited to execute arbitrary code by sending specially crafted messages to the server.

Successful exploitation requires that the server is configured with EVENTLOG=1.

The vulnerability is reported in version 2.12.0. Prior versions may also be affected.

Solution
Update to version 2.12.1.

Provided and/or discovered by
The vendor credits Luigi Auriemma.

Changelog
Further details available in Customer Area

Original Advisory
http://sourceforge.net/project/shownotes.php?release_id=490561

http://aluigi.altervista.org/adv/netrekfs-adv.txt

Deep Links
Links available in Customer Area