BFCommand & Control Server Manager Multiple Remote Vulnerabilities
BID:14690
Info
BFCommand & Control Server Manager Multiple Remote Vulnerabilities
| Bugtraq ID: | 14690 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 29 2005 12:00AM |
| Updated: | Aug 29 2005 12:00AM |
| Credit: | Luigi Auriemma <[email protected]> is credited with the discovery of these issues. |
| Vulnerable: |
BFCommand & Control Software BFVCC 2.14 _B BFCommand & Control Software BFVCC 2.0 0_A BFCommand & Control Software BFCC 1.22 _A |
| Not Vulnerable: | |
Discussion
BFCommand & Control Server Manager Multiple Remote Vulnerabilities
BFCC and BFVCC server managers are vulnerable to multiple remote vulnerabilities.
The first two issues are login bypass vulnerabilities. These issues allow remote, anonymous attackers to gain access to the affected server process.
The third issue is a design error whereby the server application implements access controls, privileges, and other commands in the client-side of the connection. This allows remote attackers to gain full administrative access to the affected application.
The fourth issue is a remote denial of service vulnerability. This issue is due to a failure of the application to properly handle multiple connections.
These vulnerabilities allow remote attackers to gain administrative access in the affected server application, and to deny further access to the application.
BFCC and BFVCC server managers are vulnerable to multiple remote vulnerabilities.
The first two issues are login bypass vulnerabilities. These issues allow remote, anonymous attackers to gain access to the affected server process.
The third issue is a design error whereby the server application implements access controls, privileges, and other commands in the client-side of the connection. This allows remote attackers to gain full administrative access to the affected application.
The fourth issue is a remote denial of service vulnerability. This issue is due to a failure of the application to properly handle multiple connections.
These vulnerabilities allow remote attackers to gain administrative access in the affected server application, and to deny further access to the application.
Exploit / POC
BFCommand & Control Server Manager Multiple Remote Vulnerabilities
A proof of concept exploit application was provided by Luigi Auriemma <[email protected]>:
A proof of concept exploit application was provided by Luigi Auriemma <[email protected]>:
Solution / Fix
BFCommand & Control Server Manager Multiple Remote Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
BFCommand & Control Server Manager Multiple Remote Vulnerabilities
References:
References:
- BTCommand & Control Software Home Page (BTCommand & Control Software)
- Multiple vulnerabilities in BFCommand & Control for Battlefield 1942 and Vietnam (Luigi Auriemma