Rakkarsoft RakNet Remote Denial of Service Vulnerability

Bugtraq ID:	13862
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2005-1899
Remote:	Yes
Local:	No
Published:	Jun 06 2005 12:00AM
Updated:	Jul 12 2009 02:56PM
Credit:	Discovery is credited to Luigi Auriemma <[email protected]>
Vulnerable:	Rakkarsoft Raknet 2.33 nFusion Interactive Elite Warriors: Vietnam 1.3
Not Vulnerable:

Rakkarsoft RakNet Remote Denial of Service Vulnerability

Rakkarsoft RakNet is affected by a remote denial of service vulnerability.

Reportedly, the vulnerability presents itself when the library handles an empty UDP packet.

RakNet 2.33 and prior versions released before May 30, 2005 are affected by this vulnerability. Various games employing the affected library may be vulnerable as well.

Rakkarsoft RakNet Remote Denial of Service Vulnerability

An exploit is not required.

The following proof of concept is available:

• /data/vulnerabilities/exploits/rakzero.zip

Rakkarsoft RakNet Remote Denial of Service Vulnerability

Solution:
Reportedly, Raknet 2.33 versions released on May 30, 2005 and subsequent are not vulnerable to this issue. This is not confirmed at the moment.

Rakkarsoft RakNet Remote Denial of Service Vulnerability

References:

• Raknet Product Page (Rakkarsoft)
  
• Server termination in Raknet 2.33 (before 30 May 2005) (Luigi Auriemma )