[HISPASEC] Blizzard StarCraft Brood War 1.15.1 Remote DoS

HISPASEC
Security Advisory
http://blog.hispasec.com/lab/

Name : Blizzard StarCraft Brood War Remote DoS
Class : Remote/Local DoS
Threat level : MED
Discovered : 2007-08-08
Published : 2007-08-29
Credit : Gynvael Coldwind
Vulnerable : StarCraft Brood War 1.15.1 and prior
StarCraft 1.15.1 and prior may also be affected


== Abstract ==

StarCraft is a real-time strategy game by Blizzard Entertainment.

StarCraft fails to handle exceptional conditions when generating a
minimap preview of a malformed map. Additionally, since StarCraft
includes a map distribution mechanizm (allowing players that do not
own a map to download it when entering a game) it is possible to send
a malformed map to a player that enters the game, and so, remotlly DoS
his application.


== Details ==

When a player enter a StarCraft Brood War game (local, lan game or an
Internet Battle.net game) a preview of the map is generated. If the
map was malformed StarCraft tries to read an area which is no
allocated. This leads to a Denial of Service condition, since
StarCraft generates a Access Volation (READ) exception which is not
handled.
Additionally, if a player enters a multiplayer game, and he does not
own a map that the game is taking place on, StarCraft download the map
from other players (not just the creator of the game). If StarCrafts
download a malformed map from a remote player, it will try to generate
a minimap and enter the DoS condition (this has been confirmed in
testing).

Since StarCraft is a full screen DirectX application a DoS may cause a
need to reboot the whole system on older Windows systems.

Proof of Concept map:
http://blog.hispasec.com/lab/files/SC_PoC_DoS.scm

Memory patcher disabling minimap preview generation:
http://blog.hispasec.com/lab/files/SC_Patch.c
http://blog.hispasec.com/lab/files/SC_Patch.exe (compiled binary)


== Vendor status and solution ==

The vendor has been informed but has not yet released a proper patch
(a fix for this issue was not included in the 1.15.1 patch).

The sollution is to becareful when joining games on unknown maps.
See SC_Patch.c and SC_Patch.exe (links in the Details section) for a
memory patcher that disables minimap preview generation in the running
StarCraft application.


== Disclaimer ==
This document and all the information it contains is provided "as is",
without any warranty. Hispasec Sistemas is not responsible for the
misuse of the information provided in this advisory. The advisory is
provided for educational purposes only.

Permission is hereby granted to redistribute this advisory, providing
that no changes are made and that the copyright notices and
disclaimers remain intact.

Copyright (C) 2007 Hispasec Sistemas.

--
Gynvael Coldwind
mailto: gynvael@xxxxxxxxxxxxx
mailto: michael@xxxxxxxxxxxx

Relevant Pages

  • [Review] StarCraft: the Board Game
    ... StarCraft: the Board Game (Fantasy Flight Games, ... in which players are attacking regions on different ...
    (rec.games.board)
  • Re: World of Starcraft for real?
    ... Starcraft fans, but I guess most of them want a RTS game). ... two substantially different types of games if they are true to the original Starcraft. ... Having spent 1/3rd of their brand recognition by mislabeling it World of Warcraft instead of Worlds of Diablo there is still an opening for an online RTS type game. ...
    (comp.sys.ibm.pc.games.rpg)
  • Re: Those Krazy Koreans!!
    ... you said it is an arcade game - Arcade strategy game ... There are most certainly elements of strategy in Starcraft. ... attack your way to victory. ... > of strategy in FPS appears to be as great as in any RTS game. ...
    (comp.sys.ibm.pc.games.strategic)
  • Re: Sonys 1 2 3 4 Punch
    ... aren't going to give a rat's ass about this game. ... the same level of popularity that Warcraft II did. ... RTS games are hard to do on a console because of the controller. ... I liked Warcraft II and Starcraft better. ...
    (alt.games.video.xbox)