Game Networking Engine ConsoleStreamBuf.CPP Format String Vulnerability

Bugtraq ID:	19154
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 25 2006 12:00AM
Updated:	Jul 27 2006 05:32PM
Credit:	Luigi Auriemma is credited with the discovery of this vulnerability.
Vulnerable:	Gillius's Programming Game Networking Engine 0.7 Gillius's Programming Game Networking Engine CVS 23 Jul 2006
Not Vulnerable:	Gillius's Programming Game Networking Engine 24 Jul 2006

Game Networking Engine ConsoleStreamBuf.CPP Format String Vulnerability

Game Networking Engine is prone to a remote format-string vulnerability.

This issue arises when the application displays a text string on the client screen during a multiplayer game. The application fails to properly sanitize user-supplied data before using it in the format-specification argument of a formatted-printing function.

A successful attack may crash the application or lead to arbitrary code execution within the context of the game server.

Version 0.70, CVS 23 July 2006 and prior are vulnerable to this issue.

Game Networking Engine ConsoleStreamBuf.CPP Format String Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]

Game Networking Engine ConsoleStreamBuf.CPP Format String Vulnerability

Solution:
The vendor has addressed this issue in the latest CVS release. Please contact the vendor for details.

Game Networking Engine ConsoleStreamBuf.CPP Format String Vulnerability

References:

• GNE format string bug in the gout console output (Luigi Auriemma )