Bug 98922 – games-strategy/netpanzer: Denial of Service because of an endless loop

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Stefan Cornelius (RETIRED) 2005-07-13 14:17:10 UTC]

Copied from adivsory: 
The network code doesn't verify the correctness of the 16 bit number
containing the size of the entire data block received from the network.
If an attacker sends the number 0x0000 (the minimum should be 0x0002)
the game enters in an endless loop and nobody can play.

PoC: http://aluigi.altervista.org/poc/panzone.zip
Fix in SVN: http://developer.berlios.de/svn/?group_id=1250

[Comment 1 Stefan Cornelius (RETIRED) 2005-07-13 14:18:35 UTC]

Games herd, please provide a patched ebuild. thanks.

[Comment 2 SpanKY 2005-07-13 19:23:51 UTC]

Created attachment 63354 [details, diff]
netpanzer-0.8-min-size-check.patch

upstream svn rewrote the network code completely and it's incompatible with the
0.8 release :/

going by the useful technical info in the advisory, ive created a small fix
against 0.8 which seems to fix the issue ...

that is, i was able to make netpanzer eat up 100% cpu w/out the patch but not
w/the patch

[Comment 3 SpanKY 2005-07-13 19:24:30 UTC]

so 0.8-r1 is now in portage and amd64/x86 stable (which are the only arches
which had a stable version < 0.8-r1)

[Comment 4 Sune Kloppenborg Jeppesen (RETIRED) 2005-07-13 22:30:16 UTC]

This one is ready for GLSA decision. I vote NO. 

[Comment 5 Stefan Cornelius (RETIRED) 2005-07-13 22:42:51 UTC]

I'm voting no, too. Closing bug, reopen if my vote doesn't count since i'm only
on probation.