[ GLSA 200609-02 ] GTetrinet: Remote code execution

[GLSA]

Gentoo Linux Security Advisory

Title: GTetrinet: Remote code execution (GLSA 200609-02)
Severity: normal
Exploitable: remote
Date: September 06, 2006
Updated: September 07, 2006
Bug(s): #144867
ID: 200609-02

Synopsis

GTetrinet is vulnerable to a remote buffer overflow, potentially leading to arbitrary code execution.

Background

GTetrinet is a networked Tetris clone for GNOME 2.

Affected Packages

Package: games-puzzle/gtetrinet
Vulnerable: < 0.7.10
Unaffected: >= 0.7.10
Architectures: All supported architectures


Description

Michael Gehring has found that GTetrinet fails to properly handle array indexes.

Impact

An attacker can potentially execute arbitrary code by sending a negative number of players to the server.

Workaround

There is no known workaround at this time.

Resolution

All GTetrinet users should upgrade to the latest version: