CVE-2004-2598 Denial of service in n/a
Remote attackers can corrupt server client state data by disconnecting improperly, potentially disrupting game mods and causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2004-2598?
CVE-2004-2598 is a medium-severity denial of service vulnerability in n/a, published on 29 Nov 2005. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Quake II server before R1Q2, as used in multiple products, allows remote attackers to corrupt the server's client state data structure by exiting a session without a valid disconnect command, then reconnecting, which prevents a mod from being notified of changes in the client state. NOTE: the impact of this issue will vary depending on which mod is being used.
Which versions are affected by CVE-2004-2598?
How do I fix CVE-2004-2598?
No fix has been published for CVE-2004-2598 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2004-2598 being exploited?
There is no known exploitation of CVE-2004-2598 in the wild and no public exploit code.
Sources
Also known as GHSA-xqff-x4hf-x674.