Executive Summary

Summary
Title New wesnoth packages fix several vulnerabilities
Informations
Name DSA-1737 First vendor Publication 2009-03-11
Vendor Debian Last vendor Modification 2009-03-11
Severity (Vendor) N/A Revision 1

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 9.3 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Several security issues have been discovered in wesnoth, a fantasy turn-based strategy game. The Common Vulnerabilities and Exposures project identifies the following problems:

CVE-2009-0366

Daniel Franke discovered that the wesnoth server is prone to a denial of service attack when receiving special crafted compressed data.

CVE-2009-0367

Daniel Franke discovered that the sandbox implementation for the python AIs can be used to execute arbitrary python code on wesnoth clients. In order to prevent this issue, the python support has been disabled. A compatibility patch was included, so that the affected campagne is still working properly.

For the stable distribution (lenny), these problems have been fixed in version 1.4.4-2+lenny1.

For the oldstable distribution (etch), these problems have been fixed in version 1.2-5.

For the testing distribution (squeeze) and the unstable distribution (sid), these problems have been fixed in version 1.4.7-4.

We recommend that you upgrade your wesnoth packages.

Original Source

Url : http://www.debian.org/security/2009/dsa-1737

CWE : Common Weakness Enumeration

% Id Name
50 % CWE-399 Resource Management Errors
50 % CWE-264 Permissions, Privileges, and Access Controls

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:13652
 
Oval ID: oval:org.mitre.oval:def:13652
Title: DSA-1737-1 wesnoth -- several vulnerabilities
Description: Several security issues have been discovered in wesnoth, a fantasy turn-based strategy game. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-0366 Daniel Franke discovered that the wesnoth server is prone to a denial of service attack when receiving special crafted compressed data. CVE-2009-0367 Daniel Franke discovered that the sandbox implementation for the python AIs can be used to execute arbitrary python code on wesnoth clients. In order to prevent this issue, the python support has been disabled. A compatibility patch was included, so that the affected campagne is still working properly. For the stable distribution, these problems have been fixed in version 1.4.4-2+lenny1. For the oldstable distribution, these problems have been fixed in version 1.2-5. For the testing distribution and the unstable distribution , these problems have been fixed in version 1.4.7-4. We recommend that you upgrade your wesnoth packages.
Family: unix Class: patch
Reference(s): DSA-1737-1
CVE-2009-0366
CVE-2009-0367
 Version: 5
Platform(s): Debian GNU/Linux 4.0
 Product(s): wesnoth
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:8370
 
Oval ID: oval:org.mitre.oval:def:8370
Title: DSA-1737 wesnoth -- several vulnerabilities
Description: Several security issues have been discovered in wesnoth, a fantasy turn-based strategy game. The Common Vulnerabilities and Exposures project identifies the following problems: Daniel Franke discovered that the wesnoth server is prone to a denial of service attack when receiving special crafted compressed data. Daniel Franke discovered that the sandbox implementation for the python AIs can be used to execute arbitrary python code on wesnoth clients. In order to prevent this issue, the python support has been disabled. A compatibility patch was included, so that the affected campagne is still working properly.
Family: unix Class: patch
Reference(s): DSA-1737
CVE-2009-0366
CVE-2009-0367
 Version: 3
Platform(s): Debian GNU/Linux 5.0
Debian GNU/Linux 4.0
 Product(s): wesnoth
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 120

OpenVAS Exploits

Date Description
2009-03-13 Name : Debian Security Advisory DSA 1737-1 (wesnoth)
File : nvt/deb_1737_1.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
53877 Wesnoth Python AI Module Hierarchical Module Name Handling Arbitrary Code Exe...
52672 Wesnoth simple_wml.cpp uncompress_buffer() Function WML File Handling DoS

Nessus® Vulnerability Scanner

Date Description
2009-03-12 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1737.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:28:15
  • Multiple Updates