Luigi Auriemma has reported some vulnerabilities in Conquest, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system.

1) A boundary error within the "metaGetServerList()" function in meta.c when receiving data from a metaserver can be exploited to cause a stack-based buffer overflow via an overly long (greater than 1024 bytes) string sent as reply from a metaserver.

Successful exploitation may allow execution of arbitrary code but requires that a user is e.g tricked into connecting to a malicious metaserver.

2) An error within the "processPacket()" function in client.c when processing "SP_CLIENTSTAT" packets can be exploited to cause memory corruption.

The vulnerabilities are reported in version 8.2a. Prior versions may also be affected.

Solution
Update to version 8.3.

Provided and/or discovered by
Luigi Auriemma

Changelog
Further details available to Secunia VIM customers

Original Advisory
Luigi Auriemma:
http://aluigi.altervista.org/adv/conquestbof-adv.txt

Conquest:
http://www.radscan.com/conquest/cq-ml/msg00169.html

Deep Links
Links available to Secunia VIM customers