|
Roger Wilco Nickname Buffer Overflow and Partial Packet DoS
|
|
Secunia Advisory:
|
SA9177
|
|
|
Release Date:
|
2003-07-07
|
|
Last Update:
|
2003-09-10
|
|
Popularity:
|
5,484 views
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
DoS
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Unpatched
|
|
| Software: | Roger Wilco 1.x
|
|
|
Secunia CVSS-2 Score:
|
Available in Secunia business solutions 
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities
|
|
| Advisory Content (Page 1 of 3) | [ 1 ] [ 2 ] [ 3 ] | |
|
Description:
Two vulnerabilities have been reported in Roger Wilco, which can be exploited by malicious people to cause a DoS (Denial of Service) on a server or other clients that potentially also may be compromised.
The first vulnerability is caused due to a boundary error in the client when handling nicknames. This can be exploited by setting an overly long nickname (516 bytes in Mark 1d3 and 33 bytes in 1.4.1.6), which may cause a buffer overflow on the server and other clients connected to it resulting in a crash and potentially allowing execution of arbitrary code.
This vulnerability also affects version 1.4.1.2 when supplying a nickname longer than 1022 bytes. However, a buffer overflow is only caused on the server and not on client systems as well.
The second vulnerability can be exploited by a malicious client to cause a DoS on a server by sending a partial "join-packet" instead of a full one. This will cause the server to freeze until the client is disconnected.
This vulnerability only affects versions Mark 1d3 and 1.4.1.6.
NOTE: The dedicated server version is not affected by the vulnerabilities.
Change Page:
[ 1 ] [ 2 ] [ 3 ]
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
