[NT] Call Of Duty Broadcast Shutdown DoS Vulnerability

From: SecuriTeam (support_at_securiteam.com)
Date: 09/07/04

  • Next message: SecuriTeam: "[UNIX] Mpg123 Buffer Overflow Due To Bugs In Header Checks Code" 
    To: list@securiteam.com
Date: 7 Sep 2004 20:22:19 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Call Of Duty Broadcast Shutdown DoS Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.callofduty.com> Call of Duty is the famous military FPS game
    developed by Infinity Ward and released in October 2003.

    The game uses special measures in its code to prevent buffer overflows.
    These measures shutdown the game whenever large input is received,
    enabling a remote denial-of-service attack against the player.

    DETAILS

    Vulnerable Systems:
     * Call of Duty version 1.4

    The game uses some anti-buffer-overflow checks that automatically shutdown
    the game if they receive an input which is too long. The result is that a
    query or a reply containing over 1024 chars is able to exploit this
    protection causing the immediate shutdown of the game on the receiving
    end.

    Both servers and clients are vulnerable to this issue. However, a server
    can exploit this issue passively with every client that is connecting,
    thus rendering gameplay impossible.

    A sample proof of concept code is available for download at
    <http://aluigi.altervista.org/poc/codboom.zip>
    http://aluigi.altervista.org/poc/codboom.zip.

    Patch Availability:
    The only official patch available is for the Linux version of the game. It
    can be found at <http://www.icculus.org/betas/cod/>
    http://www.icculus.org/betas/cod/.

    The patch for the Windows version of the game is scheduled to be released
    at the end of September.

    An unofficial patch by Luigi is provided as well, for both versions -
    <http://aluigi.altervista.org/patches/cod-14-fix.zip>
    http://aluigi.altervista.org/patches/cod-14-fix.zip.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:aluigi@autistici.org> Luigi
    Auriemma.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] Mpg123 Buffer Overflow Due To Bugs In Header Checks Code"

    Relevant Pages

    • [NEWS] Gamespy SDK Cd-Key Validation Toolkit Buffer Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Gamespy's CDKey validation toolkit is an SDK ... The problem begins by an overly long reply sent by the game client to the ... int main{ ...
      (Securiteam)
    • [NT] Yager Multiple Vulnerabilities (Multiple Buffer Overflows and DoS)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The game Yager contains multiple buffer overflows that allow attackers to ... Data Block Buffer Overflow: ...
      (Securiteam)
    • [NEWS] Serious Game Engine UDP DoS Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Note: The game engine is vulnerable on all supported platforms: Windows, ... of packets to the server, each representing the joining of a new player. ... int main{ ...
      (Securiteam)
    • [NT] Chrome Server Crash When Handling Crafted Packets
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Perspective) shooting game whose takes action on a planet of another solar ... Using a specially crafted packet it is possible to cause the game or game ... unallocated memory, into a pointer with a value of 0x00000000. ...
      (Securiteam)
    • [NT] Internet Explorer Compressed Content URL Heap Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... There is an heap overflow vulnerability discovered in Internet Explorer ... Internet Explorer 6 SP1 with the MS06-042 patch applied are vulnerable. ...
      (Securiteam)