Skulltag Remote Format String Vulnerability

Bugtraq ID:	17659
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 23 2006 12:00AM
Updated:	Apr 24 2006 06:41PM
Credit:	Discovery is credited to Luigi Auriemma.
Vulnerable:	Skulltag Skulltag 0.96f
Not Vulnerable:

Skulltag Remote Format String Vulnerability

Skulltag is reported prone to a remote format-string vulnerability.

As a result of this issue, malicious data containing format specifiers may be interpreted literally by the application, which may cause attacker-specified memory to be disclosed or corrupted, leading to arbitrary code execution.

A successful exploit could cause the application to fail or arbitrary code to run in the context of the application.

Skulltag Remote Format String Vulnerability

A proof-of-concept example is available:

• /data/vulnerabilities/exploits/skulltagfs.zip

Skulltag Remote Format String Vulnerability

Solution:

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]:[email protected]

mailto:[email protected]

Skulltag Remote Format String Vulnerability

References:

• Skulltag Homepage (Skulltag)
  
• Format string bug in Skulltag 0.96f (Luigi Auriemma )