CVE-2018-18541

In Teeworlds before 0.6.5, connection packets could be forged. There was no challenge-response involved in the connection build up. A remote attacker could send connection packets from a spoofed IP address and occupy all server slots, or even use them for a reflection attack using map download packets.

Score

CVSS 3.0 7.5 High

Status

Modified - cve@mitre.org

Published

2018-10-20

Last modified

2024-08-05

Weaknesses

CWE-20

Affected products

• Debian Linux (Debian)
• Teeworlds (Teeworlds)

References

• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00046.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00077.html
• https://bugs.debian.org/911487
• https://github.com/teeworlds/teeworlds/issues/1536
• https://teeworlds.com/?page=news&id=12544
• https://www.debian.org/security/2018/dsa-4329