CVE-2007-6041 - Vulnerability Details - OpenCVE

Buffer overflow in the Sequencer::queueMessage function in sequencer.cpp in the server in Rigs of Rods (RoR) before 0.33d SP1 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code by sending a nickname, then a vehicle name in a MSG2_USE_VEHICLE message, in which the combined length triggers the overflow.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.12777.

Key SSVC decision points have not yet been added.

Vendors	Products
Rigs Of Rogs	Rigs Of Rogs

Configuration 1 [-]

cpe:2.3:a:rigs_of_rogs:rigs_of_rogs:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://aluigi.altervista.org/adv/rorbof-adv.txt
http://aluigi.org/poc/rorbof.zip
http://forum.rigsofrods.com/index.php?topic=3140.0
http://secunia.com/advisories/27729
http://www.securityfocus.com/bid/26502
http://www.vupen.com/english/advisories/2007/3938
https://exchange.xforce.ibmcloud.com/vulnerabilities/38549

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-11-20T19:00:00

Updated: 2024-08-07T15:54:26.150Z

Reserved: 2007-11-20T00:00:00

Link: CVE-2007-6041

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2007-11-20T19:46:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2007-6041

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-11-19T00:00:00", "descriptions": [{"lang": "en", "value": "Buffer overflow in the Sequencer::queueMessage function in sequencer.cpp in the server in Rigs of Rods (RoR) before 0.33d SP1 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code by sending a nickname, then a vehicle name in a MSG2_USE_VEHICLE message, in which the combined length triggers the overflow."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "26502", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/26502"}, {"name": "ADV-2007-3938", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2007/3938"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://forum.rigsofrods.com/index.php?topic=3140.0"}, {"name": "rigsofrods-queuemessage-bo(38549)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38549"}, {"tags": ["x_refsource_MISC"], "url": "http://aluigi.altervista.org/adv/rorbof-adv.txt"}, {"tags": ["x_refsource_MISC"], "url": "http://aluigi.org/poc/rorbof.zip"}, {"name": "27729", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/27729"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-6041", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Buffer overflow in the Sequencer::queueMessage function in sequencer.cpp in the server in Rigs of Rods (RoR) before 0.33d SP1 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code by sending a nickname, then a vehicle name in a MSG2_USE_VEHICLE message, in which the combined length triggers the overflow."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "26502", "refsource": "BID", "url": "http://www.securityfocus.com/bid/26502"}, {"name": "ADV-2007-3938", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/3938"}, {"name": "http://forum.rigsofrods.com/index.php?topic=3140.0", "refsource": "CONFIRM", "url": "http://forum.rigsofrods.com/index.php?topic=3140.0"}, {"name": "rigsofrods-queuemessage-bo(38549)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38549"}, {"name": "http://aluigi.altervista.org/adv/rorbof-adv.txt", "refsource": "MISC", "url": "http://aluigi.altervista.org/adv/rorbof-adv.txt"}, {"name": "http://aluigi.org/poc/rorbof.zip", "refsource": "MISC", "url": "http://aluigi.org/poc/rorbof.zip"}, {"name": "27729", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/27729"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T15:54:26.150Z"}, "title": "CVE Program Container", "references": [{"name": "26502", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/26502"}, {"name": "ADV-2007-3938", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2007/3938"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://forum.rigsofrods.com/index.php?topic=3140.0"}, {"name": "rigsofrods-queuemessage-bo(38549)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38549"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://aluigi.altervista.org/adv/rorbof-adv.txt"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://aluigi.org/poc/rorbof.zip"}, {"name": "27729", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/27729"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-6041", "datePublished": "2007-11-20T19:00:00", "dateReserved": "2007-11-20T00:00:00", "dateUpdated": "2024-08-07T15:54:26.150Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rigs_of_rogs:rigs_of_rogs:*:*:*:*:*:*:*:*", "matchCriteriaId": "FF8F460D-6B08-4D6A-A2D3-F630E946628D", "versionEndIncluding": "0.33d", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Buffer overflow in the Sequencer::queueMessage function in sequencer.cpp in the server in Rigs of Rods (RoR) before 0.33d SP1 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code by sending a nickname, then a vehicle name in a MSG2_USE_VEHICLE message, in which the combined length triggers the overflow."}, {"lang": "es", "value": "Un desbordamiento de b\u00fafer en la funci\u00f3n Sequencer::queueMessage en el archivo sequencer.cpp en el servidor en Rigs of Rods (RoR) versiones anteriores a 0.33d SP1, permite a atacantes remotos causar una denegaci\u00f3n de servicio (bloqueo del demonio) y posiblemente ejecutar c\u00f3digo arbitrario mediante el env\u00edo de un apodo, despu\u00e9s un nombre de veh\u00edculo en un mensaje MSG2_USE_VEHICLE, en el que la longitud combinada desencadena el desbordamiento."}], "id": "CVE-2007-6041", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": true, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-11-20T19:46:00.000", "references": [{"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://aluigi.altervista.org/adv/rorbof-adv.txt"}, {"source": "cve@mitre.org", "url": "http://aluigi.org/poc/rorbof.zip"}, {"source": "cve@mitre.org", "tags": ["URL Repurposed"], "url": "http://forum.rigsofrods.com/index.php?topic=3140.0"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/27729"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/26502"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2007/3938"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38549"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://aluigi.altervista.org/adv/rorbof-adv.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://aluigi.org/poc/rorbof.zip"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["URL Repurposed"], "url": "http://forum.rigsofrods.com/index.php?topic=3140.0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/27729"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/26502"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2007/3938"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38549"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "nvd@nist.gov", "type": "Primary"}]}