full-disclosure - Crash in Stronghold 2 1.2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon May 30 17:19:40 2005
From: aluigi at autistici.org (Luigi Auriemma)
Subject: Crash in Stronghold 2 1.2

#######################################################################

                             Luigi Auriemma

Application:  Stronghold 2
              http://www.stronghold2.com
Versions:     <= 1.2
Platforms:    Windows
Bug:          exception/crash
Exploitation: remote, versus server
Date:         30 May 2005
Author:       Luigi Auriemma
              e-mail: aluigi@...istici.org
              web:    http://aluigi.altervista.org

#######################################################################

1) Introduction
2) Bug
3) The Code
4) Fix

#######################################################################

===============
1) Introduction
===============

Stronghold 2 is a stategic game developed by Firefly Studios
(http://www.fireflyworlds.com) and published by 2K Games
(http://www.2kgames.com).
It has been released in April 2005.

#######################################################################

======
2) Bug
======

In the packet used for joining the server is locatd the client's
nickname preceded by a 32 bit number used to specify its size.
When the server receives the packet it reads this number and allocates
that amount of memory where, then, will be copied the nickname.
The problem is that the STLport library fails to allocate a too big
amount of memory and generates an exception that terminates the game.

#######################################################################

===========
3) The Code
===========

http://aluigi.altervista.org/poc/strong2boom.zip

#######################################################################

======
4) Fix
======

No fix.
No reply from the vendor.

#######################################################################

--- 
Luigi Auriemma
http://aluigi.altervista.org