bugtraq - Broadcast shutdown in Call of Duty 1.4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sun, 5 Sep 2004 17:02:06 +0000
From: Luigi Auriemma <aluigi@...istici.org>
To: bugtraq@...urityfocus.com, bugs@...uritytracker.com, news@...uriteam.com,
   full-disclosure@...ts.netsys.com
Subject: Broadcast shutdown in Call of Duty 1.4

#######################################################################

                             Luigi Auriemma

Application:  Call of Duty
              http://www.callofduty.com
Versions:     <= 1.4
Platforms:    Windows and Linux
Bug:          Denial of Service
Risk:         high
Exploitation: remote, versus servers and clients (broadcast)
Date:         05 September 2004
Author:       Luigi Auriemma
              e-mail: aluigi@...ervista.org
              web:    http://aluigi.altervista.org

#######################################################################

1) Introduction
2) Bug
3) The Code
4) Fix

#######################################################################

===============
1) Introduction
===============

Call of Duty is the famous military FPS game developed by Infinity Ward
(http://www.infinityward.com) and released in October 2003.

An interesting note is that this security bug was already known by some
people since the release of my recent Medal of Honor buffer-overflow
(17 July 2004), in fact the same proof-of-concept works perfectly with
Call of Duty too.

#######################################################################

======
2) Bug
======

The game uses some anti-buffer-overflow checks that automatically
shutdown the game if they find a too big input.

The result is that a query or a reply containing over 1024 chars is
able to exploit this protection causing the immediate stop of the game.

Both servers and clients are vulnerables and the major problem is just
for clients because a single malicious server is able to passively stop
any client in the world so nobody can play online.

#######################################################################

===========
3) The Code
===========

http://aluigi.altervista.org/poc/codboom.zip

#######################################################################

======
4) Fix
======

Only the official patch for the Linux version is available (since some
weeks) and can be downloaded here:

  http://www.icculus.org/betas/cod/

The Windows patch is not available and "probably" will be released at
the end of September.

In the meantime I have written an unofficial fix just for the 1.4 Win32
version of the game and is able to patch both clients and servers
because the function is the same:

  http://aluigi.altervista.org/patches/cod-14-fix.zip

#######################################################################

--- 
Luigi Auriemma
http://aluigi.altervista.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html