Buffer overflow in the ulSetError function in util/ulError.cxx in PLIB 1.8.5, as used in TORCS 1.3.1 and other products, allows user-assisted remote attackers to execute arbitrary code via vectors involving a long error message, as demonstrated by a crafted acc file for TORCS. NOTE: some of these details are obtained from third party information.

The remote host is affected by the vulnerability described in GLSA-201606-16 (PLIB: Buffer overflow vulnerability)

    A buffer overflow in PLIB allows user-assisted remote attackers to       execute arbitrary code via vectors involving a long error message, as       demonstrated by a crafted acc file for TORCS.
  Impact :

    Remote attackers could execute arbitrary code with the privileges of the       process.
  Workaround :

    There is no known workaround at this time.

This update of plib fixed two stack-based buffer overflows.

Secunia reports :

A vulnerability has been discovered in PLIB, which can be exploited by malicious people to compromise an application using the library. The vulnerability is caused due to a boundary error within the 'ulSetError()' function (src/util/ulError.cxx) when creating the error message, which can be exploited to overflow a static buffer.

Successful exploitation allows the execution of arbitrary code but requires that the attacker can e.g. control the content of an overly long error message passed to the 'ulSetError()' function.

The vulnerability is confirmed in version 1.8.5. Other versions may also be affected.

Originally reported in TORCS by Andres Gomez.

It was discovered that PLIB, a library used by TORCS, contains a buffer overflow in error message processing, which could allow remote attackers to execute arbitrary code.

Secunia reports :

A vulnerability has been discovered in PLIB, which can be exploited by malicious people to compromise an application using the library.

The vulnerability is caused due to a boundary error within the 'ulSetError()' function (src/util/ulError.cxx) when creating the error message, which can be exploited to overflow a static buffer.

Successful exploitation allows the execution of arbitrary code but requires that the attacker can e.g. control the content of an overly long error message passed to the 'ulSetError()' function.

The vulnerability is confirmed in version 1.8.5. Other versions may also be affected.

Fix a buffer overflow in ulSetError() (CVE-2011-4620)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix a buffer-overflow in ulSetError() (CVE-2011-4620)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
91847	GLSA-201606-16 : PLIB: Buffer overflow vulnerability	Nessus	Gentoo Local Security Checks	high
74811	openSUSE Security Update : plib (openSUSE-SU-2012:1506-1)	Nessus	SuSE Local Security Checks	high
66507	FreeBSD : plib -- buffer overflow (13bf0602-c08a-11e2-bb21-083e8ed0f47b)	Nessus	FreeBSD Local Security Checks	high
58200	Debian DSA-2425-1 : plib - buffer overflow	Nessus	Debian Local Security Checks	high
58021	FreeBSD : plib -- remote code execution via buffer overflow (ba51c2f7-5b43-11e1-8288-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high
57545	Fedora 15 : plib-1.8.5-5.fc15 (2012-0144)	Nessus	Fedora Local Security Checks	high
57544	Fedora 16 : plib-1.8.5-5.fc16 (2012-0100)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2011-4620

critical

Tenable Plugins

high

high

high

high

high

high

high