Roger Wilco Information Disclosure Vulnerability

Bugtraq ID:	10024
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 31 2004 12:00AM
Updated:	Mar 31 2004 12:00AM
Credit:	Discovery of this vulnerability has been credited to Luigi Auriemma <[email protected]>.
Vulnerable:	GameSpy Roger Wilco Graphical Server 1.4.1 .6 GameSpy Roger Wilco Graphical Server 1.4.1 .5 GameSpy Roger Wilco Graphical Server 1.4.1 .4 GameSpy Roger Wilco Graphical Server 1.4.1 .3 GameSpy Roger Wilco Graphical Server 1.4.1 .2 GameSpy Roger Wilco Graphical Server 1.4.1 .1 GameSpy Roger Wilco Dedicated Server (Win32) 0.30 a GameSpy Roger Wilco Dedicated Server (Win32) 0.29 GameSpy Roger Wilco Dedicated Server (Win32) 0.28 GameSpy Roger Wilco Dedicated Server (Win32) 0.27 GameSpy Roger Wilco Dedicated Server (Win32) 0.26 GameSpy Roger Wilco Dedicated Server (Linux,BSD) 0.27 GameSpy Roger Wilco Dedicated Server (Linux,BSD) 0.26 GameSpy Roger Wilco 1.4.1 .6 GameSpy Roger Wilco 1.4.1 .2 GameSpy Roger Wilco Mark 1d3
Not Vulnerable:

Roger Wilco Information Disclosure Vulnerability

Roger Wilco Server has been reported prone to an information disclosure vulnerability. The issue presents itself in procedures used to negotiate client connections. Specifically, when a client attempts to join a channel on the affected server, the entire user ID's list and their corresponding IP addresses are relayed to the client.

Roger Wilco Information Disclosure Vulnerability

There is no exploit required.

Roger Wilco Information Disclosure Vulnerability

Solution:
This software is no longer supported.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Roger Wilco Information Disclosure Vulnerability

References:

• Roger Wilco Home Page (GameSpy)
  
• RogerWilco: new funny bugs (Luigi Auriemma )