Description
netrek-client-cow through 3.3.3 contains a stack-based buffer overflow vulnerability in handleSMessage() in short.c that allows malicious servers to overflow a 100-byte stack buffer by sending oversized SP_S_MESSAGE packets. A malicious Netrek server or man-in-the-middle on the plaintext TCP connection can send overlong or unterminated message bodies to write server-controlled bytes onto the stack and crash the client.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| quozl | netrek-client-cow | ≤ 3.3.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | netrek-client-cow | No fix yet | — |
| Ubuntu 26.04 LTS | netrek-client-cow | No fix yet | — |
| Ubuntu 24.04 LTS | netrek-client-cow | No fix yet | — |
| Ubuntu 22.04 LTS | netrek-client-cow | No fix yet | — |
| Ubuntu 20.04 LTS | netrek-client-cow | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | netrek-client-cow | No fix yet | — |
| Ubuntu 16.04 LTS | netrek-client-cow | No fix yet | — |
References
- Patch Commit patch
- https://github.com/quozl/netrek-client-cow product
- https://github.com/quozl/netrek-client-cow/blob/3.3.3/short.c#L949 technical-description
- https://github.com/quozl/netrek-client-cow/issues/11 issue-tracking
- VulnCheck Advisory: netrek-client-cow through 3.3.3 Stack Buffer Overflow via handleSMessage third-party-advisory