CVE-2006-1102 Sauerbraten 2006_02_28, as derived from the Cube engine, allows remote attackers to cause a denial of service (client exit) by forcing the server to change to a map (ogz) file whose name contains ".."...
MediumCVSS 5.0
EPSS 4.7%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Sauerbraten 2006_02_28, as derived from the Cube engine, allows remote attackers to cause a denial of service (client exit) by forcing the server to change to a map (ogz) file whose name contains ".." sequences and has a certain length that prevents the addition of the ".ogz" extension.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sauerbraten cube | = 2005-08-09 | No fix listed |
| sauerbraten | = 2006-02-28 | No fix listed |
References
- aluigi.altervista.org exploit vendor-advisory
- 19110 third-party-advisory
- 19111 third-party-advisory
- 19199 third-party-advisory
- 548 third-party-advisory
- GLSA-200603-10 vendor-advisory
- 20060306 Multiple vulnerabilities in Sauerbraten engine 2006_02_28 mailing-list
- 20060306 Multiple vulnerabilities in Cube engine 2005_08_29 mailing-list
- 16986 exploit vdb-entry
- ADV-2006-0847 vdb-entry
- ADV-2006-0848 vdb-entry
- sauerbraten-sprintf-dos(25086) vdb-entry