UFO2000 Multiple Remote Vulnerabilities

Bugtraq ID:	19035
Class:	Boundary Condition Error
CVE:	CVE-2006-3788 CVE-2006-3789 CVE-2006-3790 CVE-2006-3791
Remote:	Yes
Local:	No
Published:	Jul 18 2006 12:00AM
Updated:	Feb 26 2007 06:06PM
Credit:	Discovery is credited to Luigi Auriemma.
Vulnerable:	UFO2000 UFO2000 SVN 1057 Gentoo Linux
Not Vulnerable:	UFO2000 UFO2000 SVN 1061 UFO2000 UFO2000 SVN 1058

UFO2000 Multiple Remote Vulnerabilities

UFO2000 is affected by multiple remote vulnerabilities that arise when the application handles malicious network data.

A remote attacker may execute arbitrary code to gain unauthorized access or to crash the application, effectively denying service to legitimate users.

Versions SVN 1057 and earlier are prone to these issues; other versions may also be affected.

UFO2000 Multiple Remote Vulnerabilities

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Some of these issues may not require exploit code; merely crafting malicious network data and transmitting it to a vulnerable instance of the application may suffice.

UFO2000 Multiple Remote Vulnerabilities

Solution:
The vendor has released versions SVN 1058 and SVN 1061 to address these issues; please see the reference section for details.


UFO2000 UFO2000 SVN 1057

• UFO2000 ufo2000-0.6.627.tar.gz
  http://prdownloads.sourceforge.net/ufo2000/ufo2000-0.6.627.tar.gz

UFO2000 Multiple Remote Vulnerabilities

References:

• UFO2000 Web Site (UFO2000)
  
• Multiple vulnerabilities in UFO2000 svn 1057 (Luigi Auriemma )