Multiple buffer overflow vulnerabilities in FlightGear and SimGear

Release date: 2012-03-20
Updated on:

Affected Systems:
RedHat Fedora 17
RedHat Fedora 16
RedHat Fedora 15
FlightGear 2.6
SimGear 2.6
Description:
--------------------------------------------------------------------------------
Bugtraq id: 52967
CVE (CAN) ID: CVE-2012-2091

SimGear is an open-source library used to quickly assemble 3D simulation, games, and virtualization applications. FlightGear is an open source flight simulator.

In versions earlier than FlightGear 2.6 and earlier than SimGear 2.6, multiple buffer overflow vulnerabilities exist in the implementation. The src/OFDM/YASim/Rotor in the Rotor label of the aircraft XML model is used. the Rotor: getValueforFGSet function of cpp is a super long string, or a specially crafted UDP packet of SGSocketUDP: read function in simgear/io/sg_socket_udp.cxx, resulting in DOS or arbitrary code execution.

<* Source: Andres Gomez

Link: http://sourceforge.net/mailarchive/message.php? Ms. g_id = 29011989
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

FlightGear
----------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.flightgear.org/about/