Bug 239557 (CVE-2008-3396)

Summary:	<games-fps/ut2004-3369.3, <games-server/ut2004-ded-3369.3: DoS & NULL pointer dereference (CVE-2008-3396)
Product:	Gentoo Security	Reporter:	Stefan Behte (RETIRED) <craig>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	games
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	C3 [noglsa]
Package list:		Runtime testing required:	---

Description Stefan Behte (RETIRED) gentoo-dev

2008-10-04 16:06:55 UTC

CVE-2008-3396 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3396):
  Unreal Tournament 2004 (UT2004) 3369 and earlier allows remote
  attackers to cause a denial of service (NULL pointer dereference and
  daemon crash) via a certain sequence of malformed packets.

Comment 1 Stefan Behte (RETIRED) gentoo-dev

2008-10-04 16:10:22 UTC

Advisory from the author at:
http://aluigi.altervista.org/adv/ut2004null-adv.txt

Exploit code at:
http://www.securityfocus.com/data/vulnerabilities/exploits/30427.zip

AFAIR there is no patch.

Comment 2 Stefan Behte (RETIRED) gentoo-dev

2008-10-04 16:13:04 UTC

While seeking for another bug, I found this:
http://www.ut-x.net/UT-2004/UT2004-Server-unter-Beschuss.html

Comment 3 Christian Hoffmann (RETIRED) gentoo-dev

2008-11-10 16:38:48 UTC

games, any updates on this one?

From the page, which Craig linked:
  http://www.ut-x.net/View-document-details/298-v3369-3-linux-dedicated-hotfix.html
  http://www.ut-x.net/View-document-details/296-Linux-Server-1.3-HOTFIX-09192008.html

Comment 4 Tristan Heaven (RETIRED) gentoo-dev

2009-09-03 13:45:27 UTC

Fixed in games-server/ut2004-ded-3369.3

Fixed the "Dedicated" server (ucc-bin) in games-fps/ut2004-3369.3. I'm not sure if the "Listen" server in the game binary (ut2004-bin) is affected as no patch was provided.

Comment 5 Sean Amoss (RETIRED) gentoo-dev

2012-03-09 15:01:02 UTC

Thanks, everyone. GLSA vote: no.

Comment 6 Tim Sammut (RETIRED) gentoo-dev

2012-03-11 06:56:04 UTC

GLSA Vote: no, too. closing.