Search...

Doomsday (aka deng) d_net.c D_NetPlayerEvent Function PKT_CHAT Message Remote Overflow

2007-08-29T12:21:36

ID OSVDB:40130
Type osvdb
Reporter OSVDB
Modified 2007-08-29T12:21:36

Description

No description provided by the source

References:

Vendor URL: http://www.dengine.net/ Vendor URL: http://www.doomsdayhq.com/ Secunia Advisory ID:26524 Related OSVDB ID: 40132 Related OSVDB ID: 40133 Related OSVDB ID: 40131 Related OSVDB ID: 40134 Other Advisory URL: http://aluigi.altervista.org/adv/dumsdei-adv.txt Other Advisory URL: http://aluigi.org/poc/dumsdei.zip Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2007-08/0460.html ISS X-Force ID: 36334 ISS X-Force ID: 36332 ISS X-Force ID: 36333 CVE-2007-4642 Bugtraq ID: 25483

JSON Vulners Source

Initial Source

{"bulletinFamily": "software", "viewCount": 0, "reporter": "OSVDB", "references": [], "description": "# No description provided by the source\n\n## References:\nVendor URL: http://www.dengine.net/\nVendor URL: http://www.doomsdayhq.com/\n[Secunia Advisory ID:26524](https://secuniaresearch.flexerasoftware.com/advisories/26524/)\n[Related OSVDB ID: 40132](https://vulners.com/osvdb/OSVDB:40132)\n[Related OSVDB ID: 40133](https://vulners.com/osvdb/OSVDB:40133)\n[Related OSVDB ID: 40131](https://vulners.com/osvdb/OSVDB:40131)\n[Related OSVDB ID: 40134](https://vulners.com/osvdb/OSVDB:40134)\nOther Advisory URL: http://aluigi.altervista.org/adv/dumsdei-adv.txt\nOther Advisory URL: http://aluigi.org/poc/dumsdei.zip\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2007-08/0460.html\nISS X-Force ID: 36334\nISS X-Force ID: 36332\nISS X-Force ID: 36333\n[CVE-2007-4642](https://vulners.com/cve/CVE-2007-4642)\nBugtraq ID: 25483\n", "affectedSoftware": [], "hashmap": [{"key": "affectedSoftware", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "bulletinFamily", "hash": "f9fa10ba956cacf91d7878861139efb9"}, {"key": "cvelist", "hash": "ee718360723b14751e81d4a0878b2897"}, {"key": "cvss", "hash": "2bdabeb49c44761f9565717ab0e38165"}, {"key": "description", "hash": "7774652d1d91c7521bd214cfb8a62b40"}, {"key": "href", "hash": "b6dabde05c3bf4ce277ecf4a277d54cd"}, {"key": "modified", "hash": "1723abf1e5baa0a4afa19ab9bf385f5a"}, {"key": "objectVersion", "hash": "56765472680401499c79732468ba4340"}, {"key": "published", "hash": "1723abf1e5baa0a4afa19ab9bf385f5a"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "955b328dc7cd615c13af5464c9183464"}, {"key": "title", "hash": "d07e983a50eeed552d460cbd0f42c2f1"}, {"key": "type", "hash": "1327ac71f7914948578f08c54f772b10"}], "href": "https://vulners.com/osvdb/OSVDB:40130", "modified": "2007-08-29T12:21:36", "objectVersion": "1.2", "enchantments": {"score": {"value": 7.5, "vector": "NONE"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2007-4642"]}, {"type": "osvdb", "idList": ["OSVDB:40132", "OSVDB:40131"]}, {"type": "exploitdb", "idList": ["EDB-ID:30543"]}, {"type": "nessus", "idList": ["GENTOO_GLSA-200802-02.NASL"]}, {"type": "gentoo", "idList": ["GLSA-200802-02"]}, {"type": "openvas", "idList": ["OPENVAS:60379"]}], "modified": "2017-04-28T13:20:36"}, "vulnersScore": 7.5}, "id": "OSVDB:40130", "title": "Doomsday (aka deng) d_net.c D_NetPlayerEvent Function PKT_CHAT Message Remote Overflow", "hash": "359314697d335b645030a2e83dbb18b53c6161f78b03c1edf42f0c6462639622", "edition": 1, "published": "2007-08-29T12:21:36", "type": "osvdb", "history": [], "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "cvelist": ["CVE-2007-4642"], "lastseen": "2017-04-28T13:20:36"}

{"cve": [{"lastseen": "2018-10-16T10:51:37", "bulletinFamily": "NVD", "description": "Multiple buffer overflows in Doomsday (aka deng) 1.9.0-beta5.1 and earlier allow remote attackers to execute arbitrary code via a long chat (PKT_CHAT) message that is not properly handled by the (1) D_NetPlayerEvent function in d_net.c or the (2) Msg_Write function in net_msg.c, or (3) many commands that are not properly handled by the NetSv_ReadCommands function in d_netsv.c; or (4) cause a denial of service (daemon crash) via a chat (PKT_CHAT) message without a final '\\0' character.", "modified": "2018-10-15T17:36:46", "published": "2007-08-31T19:17:00", "id": "CVE-2007-4642", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-4642", "title": "CVE-2007-4642", "type": "cve", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "osvdb": [{"lastseen": "2017-04-28T13:20:36", "bulletinFamily": "software", "description": "# No description provided by the source\n\n## References:\nVendor URL: http://www.dengine.net/\nVendor URL: http://www.doomsdayhq.com/\n[Secunia Advisory ID:26524](https://secuniaresearch.flexerasoftware.com/advisories/26524/)\n[Related OSVDB ID: 40130](https://vulners.com/osvdb/OSVDB:40130)\n[Related OSVDB ID: 40133](https://vulners.com/osvdb/OSVDB:40133)\n[Related OSVDB ID: 40131](https://vulners.com/osvdb/OSVDB:40131)\n[Related OSVDB ID: 40134](https://vulners.com/osvdb/OSVDB:40134)\nOther Advisory URL: http://aluigi.altervista.org/adv/dumsdei-adv.txt\nOther Advisory URL: http://aluigi.org/poc/dumsdei.zip\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2007-08/0460.html\nISS X-Force ID: 36334\nISS X-Force ID: 36332\nISS X-Force ID: 36333\n[CVE-2007-4642](https://vulners.com/cve/CVE-2007-4642)\nBugtraq ID: 25483\n", "modified": "2007-08-29T12:21:36", "published": "2007-08-29T12:21:36", "href": "https://vulners.com/osvdb/OSVDB:40132", "id": "OSVDB:40132", "title": "Doomsday (aka deng) d_netsv.c NetSv_ReadCommands Function PKT_CHAT Message Remote Overflow", "type": "osvdb", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-04-28T13:20:36", "bulletinFamily": "software", "description": "# No description provided by the source\n\n## References:\nVendor URL: http://www.dengine.net/\nVendor URL: http://www.doomsdayhq.com/\n[Secunia Advisory ID:26524](https://secuniaresearch.flexerasoftware.com/advisories/26524/)\n[Related OSVDB ID: 40130](https://vulners.com/osvdb/OSVDB:40130)\n[Related OSVDB ID: 40132](https://vulners.com/osvdb/OSVDB:40132)\n[Related OSVDB ID: 40133](https://vulners.com/osvdb/OSVDB:40133)\n[Related OSVDB ID: 40134](https://vulners.com/osvdb/OSVDB:40134)\nOther Advisory URL: http://aluigi.altervista.org/adv/dumsdei-adv.txt\nOther Advisory URL: http://aluigi.org/poc/dumsdei.zip\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2007-08/0460.html\nISS X-Force ID: 36334\nISS X-Force ID: 36332\nISS X-Force ID: 36333\n[CVE-2007-4642](https://vulners.com/cve/CVE-2007-4642)\nBugtraq ID: 25483\n", "modified": "2007-08-29T12:21:36", "published": "2007-08-29T12:21:36", "href": "https://vulners.com/osvdb/OSVDB:40131", "id": "OSVDB:40131", "title": "Doomsday (aka deng) net_msg.c Msg_Write Function PKT_CHAT Message Remote Overflow", "type": "osvdb", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "exploitdb": [{"lastseen": "2016-02-03T12:35:16", "bulletinFamily": "exploit", "description": "Doomsday Engine 1.8.6/1.9 Multiple Remote Vulnerabilities. CVE-2007-4642. Remote exploit for linux platform", "modified": "2007-08-29T00:00:00", "published": "2007-08-29T00:00:00", "id": "EDB-ID:30543", "href": "https://www.exploit-db.com/exploits/30543/", "type": "exploitdb", "title": "Doomsday Engine 1.8.6/1.9 - Multiple Remote Vulnerabilities", "sourceData": "source: http://www.securityfocus.com/bid/25483/info\r\n\r\nDoomsday Engine is prone to multiple remote vulnerabilities, including multiple buffer-overflow issues, a denial-of-service issue, a format-string issue, and an integer-overflow issue.\r\n\r\nAn attacker can exploit these issues to execute arbitrary code within the context of the affected application or crash the application, denying service to legitimate users.\r\n\r\nDoomsday Engine 1.90-beta5.1 is vulnerable; other versions may also be affected.\r\n\r\nhttps://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/30543.zip", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "https://www.exploit-db.com/download/30543/"}], "nessus": [{"lastseen": "2019-02-21T01:10:41", "bulletinFamily": "scanner", "description": "The remote host is affected by the vulnerability described in GLSA-200802-02 (Doomsday: Multiple vulnerabilities)\n\n Luigi Auriemma discovered multiple buffer overflows in the D_NetPlayerEvent() function, the Msg_Write() function and the NetSv_ReadCommands() function. He also discovered errors when handling chat messages that are not NULL-terminated (CVE-2007-4642) or contain a short data length, triggering an integer underflow (CVE-2007-4643).\n Furthermore a format string vulnerability was discovered in the Cl_GetPackets() function when processing PSV_CONSOLE_TEXT messages (CVE-2007-4644).\n Impact :\n\n A remote attacker could exploit these vulnerabilities to execute arbitrary code with the rights of the user running the Doomsday server or cause a Denial of Service by sending specially crafted messages to the server.\n Workaround :\n\n There is no known workaround at this time.", "modified": "2018-08-10T00:00:00", "id": "GENTOO_GLSA-200802-02.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=30244", "published": "2008-02-11T00:00:00", "title": "GLSA-200802-02 : Doomsday: Multiple vulnerabilities", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 200802-02.\n#\n# The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(30244);\n script_version(\"1.13\");\n script_cvs_date(\"Date: 2018/08/10 18:07:07\");\n\n script_cve_id(\"CVE-2007-4642\", \"CVE-2007-4643\", \"CVE-2007-4644\");\n script_xref(name:\"GLSA\", value:\"200802-02\");\n\n script_name(english:\"GLSA-200802-02 : Doomsday: Multiple vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-200802-02\n(Doomsday: Multiple vulnerabilities)\n\n Luigi Auriemma discovered multiple buffer overflows in the\n D_NetPlayerEvent() function, the Msg_Write() function and the\n NetSv_ReadCommands() function. He also discovered errors when handling\n chat messages that are not NULL-terminated (CVE-2007-4642) or contain a\n short data length, triggering an integer underflow (CVE-2007-4643).\n Furthermore a format string vulnerability was discovered in the\n Cl_GetPackets() function when processing PSV_CONSOLE_TEXT messages\n (CVE-2007-4644).\n \nImpact :\n\n A remote attacker could exploit these vulnerabilities to execute\n arbitrary code with the rights of the user running the Doomsday server\n or cause a Denial of Service by sending specially crafted messages to\n the server.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/200802-02\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"While some of these issues could be resolved in\n 'games-fps/doomsday-1.9.0-beta5.2', the format string vulnerability\n (CVE-2007-4644) remains unfixed. We recommend that users unmerge\n Doomsday:\n # emerge --unmerge games-fps/doomsday\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cwe_id(94, 119);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:doomsday\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2008/02/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2008/02/11\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2008-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"games-fps/doomsday\", unaffected:make_list(), vulnerable:make_list(\"le 1.9.0_beta52\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"Doomsday\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "gentoo": [{"lastseen": "2016-09-06T19:46:10", "bulletinFamily": "unix", "description": "### Background\n\nThe Doomsday Engine (deng) is a modern gaming engine for popular ID games like Doom, Heretic and Hexen. \n\n### Description\n\nLuigi Auriemma discovered multiple buffer overflows in the D_NetPlayerEvent() function, the Msg_Write() function and the NetSv_ReadCommands() function. He also discovered errors when handling chat messages that are not NULL-terminated (CVE-2007-4642) or contain a short data length, triggering an integer underflow (CVE-2007-4643). Furthermore a format string vulnerability was discovered in the Cl_GetPackets() function when processing PSV_CONSOLE_TEXT messages (CVE-2007-4644). \n\n### Impact\n\nA remote attacker could exploit these vulnerabilities to execute arbitrary code with the rights of the user running the Doomsday server or cause a Denial of Service by sending specially crafted messages to the server. \n\n### Workaround\n\nThere is no known workaround at this time. \n\n### Resolution\n\nWhile some of these issues could be resolved in \"games-fps/doomsday-1.9.0-beta5.2\", the format string vulnerability (CVE-2007-4644) remains unfixed. We recommend that users unmerge Doomsday: \n \n \n # emerge --unmerge games-fps/doomsday", "modified": "2008-02-10T00:00:00", "published": "2008-02-06T00:00:00", "id": "GLSA-200802-02", "href": "https://security.gentoo.org/glsa/200802-02", "type": "gentoo", "title": "Doomsday: Multiple vulnerabilities", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "openvas": [{"lastseen": "2017-07-24T12:49:44", "bulletinFamily": "scanner", "description": "The remote host is missing updates announced in\nadvisory GLSA 200802-02.", "modified": "2017-07-07T00:00:00", "published": "2008-09-24T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=60379", "id": "OPENVAS:60379", "title": "Gentoo Security Advisory GLSA 200802-02 (doomsday)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from Gentoo's XML based advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Multiple vulnerabilities in Doomsday might allow remote execution of\narbitrary code or a Denial of Service.\";\ntag_solution = \"While some of these issues could be resolved in\n'games-fps/doomsday-1.9.0-beta5.2', the format string vulnerability\n(CVE-2007-4644) remains unfixed. We recommend that users unmerge Doomsday:\n\n # emerge --unmerge games-fps/doomsday\n\nhttp://www.securityspace.com/smysecure/catid.html?in=GLSA%20200802-02\nhttp://bugs.gentoo.org/show_bug.cgi?id=190835\";\ntag_summary = \"The remote host is missing updates announced in\nadvisory GLSA 200802-02.\";\n\n \n\nif(description)\n{\n script_id(60379);\n script_version(\"$Revision: 6596 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 11:21:37 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2008-09-24 21:14:03 +0200 (Wed, 24 Sep 2008)\");\n script_cve_id(\"CVE-2007-4642\", \"CVE-2007-4643\", \"CVE-2007-4644\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Gentoo Security Advisory GLSA 200802-02 (doomsday)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Gentoo Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = ispkgvuln(pkg:\"games-fps/doomsday\", unaffected: make_list(), vulnerable: make_list(\"le 1.9.0_beta52\"))) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}