Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 111421 - games-strategy/scorched3d-39.1: Multiple Vulnerabilities
Summary: games-strategy/scorched3d-39.1: Multiple Vulnerabilities
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High major (vote)
Assignee: Gentoo Security
Whiteboard: B1 [glsa] jaervosz
Depends on:
Reported: 2005-11-03 15:37 UTC by Carsten Lohrke (RETIRED)
Modified: 2006-08-11 02:41 UTC (History)
8 users (show)

See Also:
Package list:
Runtime testing required: ---

advisory.txt (advisory.txt,6.91 KB, text/plain)
2005-11-03 15:39 UTC, Carsten Lohrke (RETIRED)
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Carsten Lohrke (RETIRED) gentoo-dev 2005-11-03 15:37:37 UTC
Versions:     <= 39.1 (bf)
Bugs:         A] format string and buffer-overflow in addLine and
              B] server freeze through negative numplayers
              C] ComsMessageHandler buffer-overflow
              D] various crashes and possible code execution in
Exploitation: remote, versus server
Comment 1 Carsten Lohrke (RETIRED) gentoo-dev 2005-11-03 15:39:27 UTC
Created attachment 72076 [details]

Luigi Auriemma's advisory web page links are dead, so here's a text copy from
Comment 2 Mr. Bones. (RETIRED) gentoo-dev 2005-11-04 08:40:34 UTC
Package masked until upstream addresses the issue.
Comment 3 Thierry Carrez (RETIRED) gentoo-dev 2005-11-05 09:42:19 UTC
Maybe a masking GLSA is in order.
Comment 4 Thierry Carrez (RETIRED) gentoo-dev 2005-11-10 06:59:39 UTC
Security please vote on masking GLSA need.

Should we issue a GLSA describing the issue and advising users to unmerge the
package ? This masking GLSA would be updated with a final one when/if this is
fixed upstream one day.
Comment 5 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2005-11-10 07:06:41 UTC
I tend to vote YES, this is not DoS only. 
Comment 6 Tavis Ormandy (RETIRED) gentoo-dev 2005-11-14 01:24:49 UTC
vote YES on masking glsa.
Comment 7 Thierry Carrez (RETIRED) gentoo-dev 2005-11-14 02:35:42 UTC
Then we should do one. I'll handle it...
Comment 8 Thierry Carrez (RETIRED) gentoo-dev 2005-11-15 04:52:54 UTC
Mask GLSA 200511-12
Setting to enhancement, Waiting on upstream version fix.
Comment 9 FieldySnuts 2006-06-14 09:52:28 UTC
Any word from upstream on this?
Comment 10 Chris Gianelloni (RETIRED) gentoo-dev 2006-06-14 13:50:31 UTC
Upstream is dead.  However, I've been working with the Fedora packager to try to sync up our patches between our two distributions.  It might be a little while, but I'll get to it.
Comment 11 FieldySnuts 2006-06-14 20:36:52 UTC
Great, thanks so much for the work and the update!

Comment 12 pvint 2006-07-15 07:42:16 UTC
These bugs have been addressed for the soon to be released v40 of this.

Referencing the bugs as listed in "advisory.txt":

A] format string and buffer-overflow in addLine and SendString*

vsprintf is no longer used at all.

B] server freeze through negative numplayers

These values now use an unsigned int

C] ComsMessageHandler buffer-overflow

sprintf has been replaced by snprintf to prevent this.

D] various crashes and possible code execution in Logger.cpp

These have been addressed in the same fashion as the string overflows above.

Version 40 of Scorched3d will be released over the next couple days, and I'm looking forward to getting it back into the portage tree!

Diff for scorched3d-40.ebuild:
diff scorched3d-39.1-r1.ebuild scorched3d-40.ebuild
< # $Header: /var/cvsroot/gentoo-x86/games-strategy/scorched3d/scorched3d-39.1-r1.ebuild,v 1.1 2006/05/12 18:40:23 wolf31o2 Exp $
> # $Header: /var/cvsroot/gentoo-x86/games-strategy/scorched3d/scorched3d-40.ebuild,v 1.0 2006/07/09 13:34:00 cbx550f Exp $
< KEYWORDS="~amd64 ~ppc ~x86"
< IUSE="mysql"
> KEYWORDS="~amd64 ~ppc x86"
> IUSE="mysql vorbis"
<       mysql? ( dev-db/mysql )"
>       mysql? ( dev-db/mysql )
>       vorbis? ( media-libs/libvorbis )"
>               $(use_with vorbis) \
<       insinto "${GAMES_DATADIR}/scorched3d/data/globalmods/apoc/data/textures/explode/"
<       doins "${FILESDIR}/smoke-orange.bmp" || die "doins failed" #bug #105237

Thank you

Paul Vint (aka cbx550f)
Comment 13 Chris Gianelloni (RETIRED) gentoo-dev 2006-08-09 08:36:36 UTC
OK.  Version 40 is released and in the tree.
Comment 14 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2006-08-09 11:27:26 UTC
Thx Chris.

Arches please test and mark stable.
Comment 15 Tobias Scherbaum (RETIRED) gentoo-dev 2006-08-09 13:03:59 UTC
ppc stable
Comment 16 Joshua Jackson (RETIRED) gentoo-dev 2006-08-09 21:06:39 UTC
x86 is stable.
Comment 17 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2006-08-10 00:43:11 UTC
This one is ready for GLSA.
Comment 18 Raphael Marichez (Falco) (RETIRED) gentoo-dev 2006-08-11 02:41:57 UTC
glsa-update sent (200511-12), closing.