Description
Netrek-client-cow through 3.3.3 contains an out-of-bounds read vulnerability in short.c handleSMessage() that allows malicious servers to crash clients via an unchecked m_recpt index. Attackers controlling a Netrek server or intercepting the plaintext TCP connection can send SP_S_MESSAGE packets with m_recpt of 36 or more, reading past players[] and shipnos to deny service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| quozl | netrek-client-cow | ≤ 3.3.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | netrek-client-cow | No fix yet | — |
| Ubuntu 26.04 LTS | netrek-client-cow | No fix yet | — |
| Ubuntu 24.04 LTS | netrek-client-cow | No fix yet | — |
| Ubuntu 22.04 LTS | netrek-client-cow | No fix yet | — |
| Ubuntu 20.04 LTS | netrek-client-cow | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | netrek-client-cow | No fix yet | — |
| Ubuntu 16.04 LTS | netrek-client-cow | No fix yet | — |
References
- Patch Commit patch
- https://github.com/quozl/netrek-client-cow product
- https://github.com/quozl/netrek-client-cow/blob/3.3.3/short.c#L942-L943 technical-description
- VulnCheck Advisory: Netrek-client-cow through 3.3.3 Out-of-Bounds Read via SP_S_MESSAGE Packets third-party-advisory