Executive Summary

NameCVE-2011-4620First vendor Publication2011-12-30
VendorCveLast vendor Modification2013-06-25

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score9.3Attack RangeNetwork
Cvss Impact Score10Attack ComplexityMedium
Cvss Expoit Score8.6AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores


Buffer overflow in the ulSetError function in util/ulError.cxx in PLIB 1.8.5, as used in TORCS 1.3.1 and other products, allows user-assisted remote attackers to execute arbitrary code via vectors involving a long error message, as demonstrated by a crafted acc file for TORCS. NOTE: some of these details are obtained from third party information.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4620

CWE : Common Weakness Enumeration

100 %CWE-119Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:15052
Oval ID: oval:org.mitre.oval:def:15052
Title: DSA-2425-1 plib -- buffer overflow
Description: It was discovered that PLIB, a library used by TORCS, contains a buffer overflow in error message processing, which could allow remote attackers to execute arbitrary code.
Family: unix Class: patch
Reference(s): DSA-2425-1
Version: 5
Platform(s): Debian GNU/Linux 6.0
Debian GNU/kFreeBSD 6.0
Product(s): plib
Definition Synopsis:

CPE : Common Platform Enumeration


OpenVAS Exploits

2012-12-13Name : SuSE Update for update openSUSE-SU-2012:1506-1 (update)
File : nvt/gb_suse_2012_1506_1.nasl
2012-11-15Name : Fedora Update for plib FEDORA-2012-17482
File : nvt/gb_fedora_2012_17482_plib_fc16.nasl
2012-03-19Name : Fedora Update for plib FEDORA-2012-0100
File : nvt/gb_fedora_2012_0100_plib_fc16.nasl
2012-03-12Name : FreeBSD Ports: torcs
File : nvt/freebsd_torcs0.nasl
2012-03-12Name : Debian Security Advisory DSA 2425-1 (plib)
File : nvt/deb_2425_1.nasl
2012-01-16Name : Fedora Update for plib FEDORA-2012-0144
File : nvt/gb_fedora_2012_0144_plib_fc15.nasl

Open Source Vulnerability Database (OSVDB)

77973PLIB src/util/ulError.cxx ulSetError() Function Error Message Parsing Remote ...

Nessus® Vulnerability Scanner

2016-06-27Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201606-16.nasl - Type : ACT_GATHER_INFO
2014-06-13Name : The remote openSUSE host is missing a security update.
File : openSUSE-2012-789.nasl - Type : ACT_GATHER_INFO
2013-05-20Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_13bf0602c08a11e2bb21083e8ed0f47b.nasl - Type : ACT_GATHER_INFO
2012-03-05Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2425.nasl - Type : ACT_GATHER_INFO
2012-02-20Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_ba51c2f75b4311e1828800262d5ed8ee.nasl - Type : ACT_GATHER_INFO
2012-01-16Name : The remote Fedora host is missing a security update.
File : fedora_2012-0100.nasl - Type : ACT_GATHER_INFO
2012-01-16Name : The remote Fedora host is missing a security update.
File : fedora_2012-0144.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

EXPLOIT-DB http://www.exploit-db.com/exploits/18258/
MLIST http://openwall.com/lists/oss-security/2011/12/21/2
SUSE http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00013.html

Alert History

If you want to see full details history, please login or register.
2016-06-28 18:54:57
  • Multiple Updates
2016-06-28 13:27:40
  • Multiple Updates
2016-04-26 21:15:54
  • Multiple Updates
2014-06-14 13:32:00
  • Multiple Updates
2014-02-17 11:06:28
  • Multiple Updates
2013-06-26 13:19:33
  • Multiple Updates
2013-05-10 23:11:10
  • Multiple Updates
2013-02-07 13:19:57
  • Multiple Updates
2013-01-30 13:21:07
  • Multiple Updates