Secunia

Luigi Auriemma has reported some vulnerabilities in Vavoom, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise a vulnerable system.

1) A format string error exists within the "SAY" command in sv_main.cpp. This can be exploited to crash the server or potentially execute arbitrary code by sending a specially crafted chat message containing format specifiers.

2) A boundary error exists within the "VThinker::BroadcastPrintf()" function in p_thinker.cpp. This can be exploited to cause a buffer overflow by sending an overly long chat message.

Successful exploitation may allow the execution of arbitrary code.

3) An assertion error exists within the "VStr::Resize()" function in str.cpp. This can be exploited to crash a server by e.g. sending a specially crafted UDP datagram to the server (default port 26000).

Solution
Use in trusted network environments only.

Provided and/or discovered by
Luigi Auriemma

Changelog
Further details available in Customer Area

Original Advisory
http://aluigi.altervista.org/adv/vaboom2-adv.txt

Deep Links
Links available in Customer Area