A vulnerability was found in Gameis Carom3D 5.06. It has been classified as problematic. This affects an unknown part. The manipulation with an unknown input leads to a resource management vulnerability. CWE is classifying the issue as CWE-399. This is going to have an impact on availability. The summary by CVE is:

The LAN game feature in Carom3D 5.06 allows remote authenticated users to cause a denial of service (application hang) via a crafted HTTP request to TCP port 28012.

The weakness was presented 06/23/2009 (Website). It is possible to read the advisory at milw0rm.com. This vulnerability is uniquely identified as CVE-2009-2173 since 06/23/2009. It is possible to initiate the attack remotely. A authentication is necessary for exploitation. Technical details are unknown but a public exploit is available.

A public exploit has been developed by LiquidWorm and been published before and not just after the advisory. The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 7 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at X-Force (51219) and Exploit-DB (8971).

Productinfo

Vendor

• Gameis

Name

• Carom3D

Version

• 5.06

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion