Description
Alien Arena 2007 6.10 and earlier allows remote attackers to cause a denial of service (client disconnect) by sending a client_connect command in a forged packet from the server to a client. NOTE: client IP addresses are available via product-specific queries.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | alien-arena | 6.05-4.1 | — |
| Debian 13 | alien-arena | 6.05-4.1 | — |
| Debian 12 | alien-arena | 6.05-4.1 | — |
References
- http://aluigi.altervista.org/adv/aa2k7x-adv.txt
- 26819 third-party-advisory
- 3105 third-party-advisory
- 25559 vdb-entry
- alienarena-clientconnect-dos(36465) vdb-entry
- 20070905 Format string and clients disconnection in Alien Arena 2007 6.10 mailing-list
- 20070905 Format string and clients disconnection in Alien Arena 2007 6.10 mailing-list
- 40508 vdb-entry
- ADV-2007-3169 vdb-entry
- http://www.quakesrc.org/forums/viewtopic.php?t=6843&start=1