CVE-2006-3393

Vulnerability

The vulnerability is in the network engine of Papyrus NASCAR Racing 4 (<=4.1.3.1.6), NASCAR Racing 2002 Season (<=1.1.0.2), and NASCAR Racing 2003 Season (<=1.2.0.1). The server uses a FIONREAD asynchronous socket that incorrectly discards UDP datagrams of size zero, but the empty datagram is not properly discarded, leading to high CPU consumption. [1]

Exploitation

An attacker can send an empty UDP datagram to any of the game's UDP ports (32766, 32767, 32768) of a server. The attacker needs network access to the server; no authentication is required. The exploit tool is provided in the advisory. [1]

Impact

Successful exploitation causes a denial of service by consuming CPU resources on the server, rendering the game unresponsive. The attacker does not gain any privilege or access to data. [1]

Mitigation

No fix is available as the games are no longer supported by the vendor. Users are advised to block the affected UDP ports at the firewall or discontinue use of the software. [1]