Alien Arena 2006 GE Multiple Remote Vulnerabilities

Bugtraq ID:	17028
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 07 2006 12:00AM
Updated:	Mar 10 2006 04:10AM
Credit:	Discovery is credited to Luigi Auriemma.
Vulnerable:	Alien Arena 2006 GE Alien Arena 2006 GE 5.0
Not Vulnerable:

Alien Arena 2006 GE Multiple Remote Vulnerabilities


Alien Arena 2006 GE is affected by a remote format-string vulnerability, a buffer-overflow vulnerability, and a denial-of-service vulnerability. These issues are due to the application's failure to properly sanitize user-supplied input.

These vulnerabilities may be leveraged to crash the service and possibly execute malicious code.

Alien Arena 2006 Gold Edition versions 5 and prior are reported to be vulnerable.

Note that the attacker must be able to connect the server with a valid keyword and must not be banned from the game server.

Alien Arena 2006 GE Multiple Remote Vulnerabilities


An exploit is not required.

Sample exploit code has been provided:

• http://www.securityfocus.com/vulnerabilities/exploits/aa2k6x.c

Alien Arena 2006 GE Multiple Remote Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Alien Arena 2006 GE Multiple Remote Vulnerabilities

References:

• Alien Arena Web Site (Alien Arena)
  
• Multiple vulnerabilities in Alien Arena 2006 GE 5.00 (Luigi Auriemma)