netris: buffer overflow [LWN.net]

Package(s):

netris

CVE #(s):

CAN-2003-0685

Created:

August 18, 2003

Updated:

September 30, 2003

Description:

Shaun Colley discovered a buffer overflow vulnerability in netris, a network version of a popular puzzle game. A netris client connecting to an untrusted netris server could be sent an unusually long data packet, which would be copied into a fixed-length buffer without bounds checking. This vulnerability could be exploited to gain the priviliges of the user running netris in client mode, if they connect to a hostile netris server.

CAN-2003-0685

Alerts:

Debian

DSA-372-1

2003-08-16

(Log in to post comments)