Pioneers Chat Buffer Denial Of Service Vulnerability

Bugtraq ID:	16429
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2006-0467
Remote:	Yes
Local:	No
Published:	Jan 30 2006 12:00AM
Updated:	Dec 13 2006 08:53PM
Credit:	Bas Wijnen is credited with the discovery of this vulnerability.
Vulnerable:	Pioneers Pioneers 0.9.40 Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 Debian Linux 3.0 sparc Debian Linux 3.0 s/390 Debian Linux 3.0 ppc Debian Linux 3.0 mipsel Debian Linux 3.0 mips Debian Linux 3.0 m68k Debian Linux 3.0 ia-64 Debian Linux 3.0 ia-32 Debian Linux 3.0 hppa Debian Linux 3.0 arm Debian Linux 3.0 alpha Debian Linux 3.0
Not Vulnerable:	Pioneers Pioneers 0.9.49

Pioneers Chat Buffer Denial Of Service Vulnerability

Pioneers is prone to a remote denial-of-service vulnerability. This issue is due to a failure in the application to handle exceptional conditions.

An attacker can exploit this issue to crash the affected Pioneers server and possibly clients connected to a vulnerable Pioneers server.

This issue is reported to affect version 0.9.40; other versions may also be vulnerable.

Pioneers Chat Buffer Denial Of Service Vulnerability


An exploit is not required.

Pioneers Chat Buffer Denial Of Service Vulnerability

Solution:


The vendor has released version 0.9.49 to address this issue. Contact the vendor for details on obtaining the appropriate updates.

Debian has released advisory DSA 964-1 to address this issue. Please see the referenced advisory for more information.

Pioneers Chat Buffer Denial Of Service Vulnerability

References:

• Debian Bug report logs - #350237 - pioneers: Client and server can crash from hu (Debian)
  
• DSA-964-1 gnocatan -- buffer overflow (Debian)
  
• Pioneers Homepage (Pioneers)
  
• Release Name: CVS snapshots (Pioneers)