Description
BomberClone 0.11.6 and earlier allows remote attackers to cause a denial of service (daemon crash) via (1) a certain malformed PKGF_ackreq packet, which triggers a crash in the rscache_add() function in pkgcache.c; and (2) an error packet, which is intended to be received by clients and force client shutdown, but also triggers server shutdown.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bomberclone | 0.11.7-1 | — |
| Debian 13 | bomberclone | 0.11.7-1 | — |
| Debian 12 | bomberclone | 0.11.7-1 | — |
| Debian 3.1 | bomberclone | 0.11.5-1sarge2 | DSA-1180-1 |
Advisories 1
- DSA-1180-1 bomberclone Debian Security (DSA / DLA) · Mar 9, 2026
References
- 21303 third-party-advisory
- 19255 vdb-entry
- 27647 vdb-entry
- DSA-1180 vendor-advisory
- http://aluigi.org/poc/bcloneboom.zip
- 27649 vdb-entry
- http://aluigi.altervista.org/adv/bcloneboom-adv.txt
- bomberclone-rscacheadd-dos(28090) vdb-entry
- bomberclone-error-packet-dos(28093) vdb-entry
- ADV-2006-3067 vdb-entry
- 21985 third-party-advisory