UDP security vulnerabilities

FEZModding / FezMultiplayerMod

Game modification for FEZ adding online multiplayer

MIT License

9 stars 0 forks source link

UDP security vulnerabilities #2

Closed Jenna1337 closed 1 week ago

Jenna1337 commented 2 months ago

UDP is a considerably vulnerable networking protocol. Consider changing to use only TCP instead.

Jenna1337 commented 2 months ago

Note: serverless mode relies on UDP, but also violates CWE-406 (Insufficient Control of Network Message Volume) and CWE-941 (Incorrectly Specified Destination in a Communication Channel), so serverless mode should probably be removed. This would also fix #1

Jenna1337 commented 2 months ago

This would likely require separating the server from the FEZ multiplayer mod, making it only available as a separate executable.