Freeciv packets.c denial of service
| freeciv-packets-dos (25166) |  Medium Risk |
Description:
Freeciv is vulnerable to a denial of service attack, caused by a vulnerability in packets.c. A remote attacker could exploit this vulnerability to cause the server to crash by sending specially-crafted packets with negative compressed size values.
Consequences:
Denial of Service
Remedy:
Upgrade to the latest version of Freeciv (2.0.8 or later), available from SourceForge.net. See References.
For Debian GNU/Linux:
Refer to DSA 994-1 for patch, upgrade, or suggested workaround information. See References.
For Gentoo Linux:
Refer to Gentoo Linux Security Announcement GLSA 2006-03-11 for patch, upgrade, or suggested workaround information. See References.
For other distributions:
Contact your vendor for patch or upgrade information.
References:
- BugTraq Mailing List, Mon Mar 06 2006 - 14:28:28 CST: Out of memory crash in Freeciv 2.0.7.
- DSA 994-1: freeciv -- denial of service.
- SourceForge.net: Files: Freeciv.
- BID-16975: Freeciv Remote Denial Of Service Vulnerability
- CVE-2006-0047: packets.c in Freeciv 2.0 before 2.0.8 allows remote attackers to cause a denial of service (server crash) via crafted packets with negative compressed size values.
- DSA-994: freeciv -- denial of service
- GLSA-200603-11: Freeciv: Denial of Service
- MDKSA-2006:053: Updated freeciv packages fix DoS vulnerabilities
- SA19120: Freeciv Packet Parsing Denial of Service Vulnerability
- VUPEN/ADV-2006-0838: Freeciv Packet Size Handling Remote Denial of Service Vulnerability
Platforms Affected:
- Debian Debian Linux 3.1
- Freeciv Freeciv 2.0 - 2.07
- Gentoo Linux
- MandrakeSoft Mandrake Linux 2006 X86_64
- MandrakeSoft Mandrake Linux 2006
Reported:
Mar 06, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net