NULL pointer in ZDaemon 1.08.07

2008.07.22
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-20


CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: None
Integrity impact: None
Availability impact: Partial

####################################################################### Luigi Auriemma Application: ZDaemon http://www.zdaemon.org Versions: <= 1.08.07 Platforms: Windows and Linux Bug: NULL pointer Exploitation: remote, versus server (in-game) Date: 21 Jul 2008 Author: Luigi Auriemma e-mail: aluigi_at_autistici&#46;org web: aluigi.org ####################################################################### 1) Introduction 2) Bug 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== ZDaemon is one of the most played multiplayer ports of the Doom engine and at the same time one of the most criticized too. ####################################################################### ====== 2) Bug ====== The ZDaemon server is affected by a NULL pointer vulnerability which allows an attacker to crash it when a specific type of command (type 6) is used. The attacker needs to join the server for exploiting this bug so his IP address must be not banned and he must know the right keyword if the server is protected with a password. ####################################################################### =========== 3) The Code =========== http://aluigi.org/poc/zdaemonull.zip ####################################################################### ====== 4) Fix ====== No fix ####################################################################### --- Luigi Auriemma http://aluigi.org http://backup.aluigi.org http://mirror.aluigi.org

References:

http://xforce.iss.net/xforce/xfdb/43946
http://www.securityfocus.com/bid/30340
http://www.securityfocus.com/archive/1/archive/1/494634/100/0/threaded
http://secunia.com/advisories/31185
http://aluigi.org/poc/zdaemonull.zip
http://aluigi.altervista.org/adv/zdaemonull-adv.txt


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top