Summary
The remote host is missing an update to openarena
announced via advisory DSA 2442-1.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202442-1
Insight
It has been discovered that spoofed getstatus UDP requests are being sent by attackers to servers for use with games derived from the Quake 3 engine (such as openarena). These servers respond with a packet flood to the victim whose IP address was impersonated by the attackers, causing a denial of service.
For the stable distribution (squeeze), this problem has been fixed in version 0.8.5-5+squeeze2.
For the testing distribution (wheezy) and the unstable distribution (sid), this problem has been fixed in version 0.8.5-6.
We recommend that you upgrade your openarena packages.
Severity
Classification
-
CVE CVE-2010-5077 -
CVSS Base Score: 7.8
AV:N/AC:L/Au:N/C:N/I:N/A:C
Related Vulnerabilities