CVE-2006-2409 Code injection in n/a

Medium 4.6 Published 16 May 2006 Updated 7 Aug 2024

Local attackers can execute arbitrary code via format string vulnerabilities in the Raydium game engine's logging function.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2006-2409?

CVE-2006-2409 is a medium-severity code injection vulnerability in n/a, published on 16 May 2006. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Format string vulnerability in the raydium_log function in console.c in Raydium before SVN revision 310 allows local users to execute arbitrary code via format string specifiers in the format parameter, which are not properly handled in a call to raydium_console_line_add.

Weakness: CWE-134

Which versions are affected by CVE-2006-2409?

It affects 1 product.

Products include Raydium Raydium.

How do I fix CVE-2006-2409?

No fix has been published for CVE-2006-2409 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2006-2409 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2006-2409 exists.

Public exploit code: 1 Exploit-DB entry.

Sources

Also known as GHSA-233m-mr87-rr74.