----------------------------------------------------------------------

BETA test the new Secunia Personal Software Inspector!

The Secunia PSI detects installed software on your computer and
categorises it as either Insecure, End-of-Life, or Up-To-Date.
Effectively enabling you to focus your attention on software
installations where more secure versions are available from the
vendors.

Download the free PSI BETA from the Secunia website:
https://psi.secunia.com/

----------------------------------------------------------------------

TITLE:
Doomsday Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA26524

VERIFY ADVISORY:
http://secunia.com/advisories/26524/

CRITICAL:
Highly critical

IMPACT:
DoS, System access

WHERE:
>From remote

SOFTWARE:
Doomsday 1.x
http://secunia.com/product/9154/

DESCRIPTION:
Luigi Auriemma has reported some vulnerabilities in Doomsday, which
can be exploited by malicious people to cause a DoS (Denial of
Service) or potentially compromise a vulnerable system.

1) A boundary error exists within the "D_NetPlayerEvent()" function
in d_net.c when processing chat messages. This can be exploited to
overflow a global buffer by sending an overly long chat message to
the affected server.

Successful exploitation may allow the execution of arbitrary code on
the game server and the connected clients.

2) A boundary error exists within the "Msg_Write()" function in
net_msg.c when processing chat messages. This can be exploited to
overflow a global buffer by sending an overly long chat message to
the affected server.

3) An integer underflow error exists within the "Sv_HandlePacket()"
in sv_main.c when processing chat messages. This can be exploited to
trigger a failure to allocate required memory, which leads to a DoS.

4) A boundary error exists within the "NetSv_ReadCommands()" function
in d_netsv.c when processing client commands. This can be exploited to
overflow a static buffer by sending more than 30 commands to the
affected server.

5) A format string error exists within the "Cl_GetPackets()" function
when processing "PSV_CONSOLE_TEXT" messages sent by the server. This
can potentially be exploited by a malicious server to execute
arbitrary code on the affected clients by sending a specially crafted
messages.

NOTE: An error in the processing of chat messages may leave a string
without a NULL character at the end. This may trigger other
vulnerabilities.

The vulnerabilities are reported in version 1.9.0-beta5.1 and prior.
Other versions may also be affected.

SOLUTION:
Host and play games on trusted networks only.

Use another product.

PROVIDED AND/OR DISCOVERED BY:
Luigi Auriemma

ORIGINAL ADVISORY:
http://aluigi.altervista.org/adv/dumsdei-adv.txt

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------