[NT] World in Conflict NULL Pointer Crash

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



World in Conflict NULL Pointer Crash
------------------------------------------------------------------------


SUMMARY

The World in Conflict server is vulneable to a Denial of Service attack
(crash) caused by the access to a NULL pointer. The problem happens in the
GetMagicNumberString function which takes the third byte of the data
received from the client on the VOIP port 52999 and returns a text string
if this value is valid ("ABC" for type 0, "DEF" for 1, "GHI" for 2 and so
on) or NULL if it's invalid. Then the string returned by this function is
compared with another one and here happens the NULL pointer access.

DETAILS

Vulnerable Systems:
* World in Conflict version 1.000 and prior

Immune Systems:
* World in Conflict version 1.00

Exploit:
Connect to the VOIP port of the server (default 52999) with telnet or
netcat and type something like aaaaaaa. The server will crash immediately.


ADDITIONAL INFORMATION

The information has been provided by <mailto:aluigi@xxxxxxxxxxxxx> Luigi
Auriemma.
The original article can be found at:
<http://aluigi.altervista.org/adv/wicvoipnull-adv.txt>
http://aluigi.altervista.org/adv/wicvoipnull-adv.txt



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [NT] Easy Chat Server Multiple Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Easy Chat suffers from vulnerabilities that allow malicious ... * Easy Char server version 1.2 ... * It is possible to crash the server by providing a very long username ...
    (Securiteam)
  • [NEWS] BZFlag Server DoS
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... BZFlag server can be caused to crash by sending it an undelimited string, ...
    (Securiteam)
  • [NEWS] Live555 RTSP Server Denial of Service
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Time Streaming Protocol (RTSP) server application released under LGPL. ... It's possible to crash Live555 server by sending specially crafted RTSP ...
    (Securiteam)
  • [NT] Multiple Vulnerabilities in HP Web JetAdmin (Read, Write, Execute, Path Disclosure, Password De
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... HP Web JetAdmin is an enterprise management system for large amounts of HP ... The web server is a modular service ... HP Web JetAdmin uses it's own encryption. ...
    (Securiteam)
  • [NEWS] Multiple Vulnerabilities in Oracle Database (Character Conversion, Extproc, Password Disclosu
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Multiple vulnerabilities were discovered in the (Oracle database server ... password is required to exploit this vulnerability. ...
    (Securiteam)