lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 30 May 2005 18:23:43 +0000
From: Luigi Auriemma <aluigi@...istici.org>
To: bugtraq@...urityfocus.com, bugs@...uritytracker.com,
	news@...uriteam.com, full-disclosure@...ts.grok.org.uk,
	vuln@...unia.com
Subject: Crash in Stronghold 2 1.2



#######################################################################

                             Luigi Auriemma

Application:  Stronghold 2
              http://www.stronghold2.com
Versions:     <= 1.2
Platforms:    Windows
Bug:          exception/crash
Exploitation: remote, versus server
Date:         30 May 2005
Author:       Luigi Auriemma
              e-mail: aluigi@...istici.org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Stronghold 2 is a stategic game developed by Firefly Studios
(http://www.fireflyworlds.com) and published by 2K Games
(http://www.2kgames.com).
It has been released in April 2005.


#######################################################################

======
2) Bug
======


In the packet used for joining the server is locatd the client's
nickname preceded by a 32 bit number used to specify its size.
When the server receives the packet it reads this number and allocates
that amount of memory where, then, will be copied the nickname.
The problem is that the STLport library fails to allocate a too big
amount of memory and generates an exception that terminates the game.


#######################################################################

===========
3) The Code
===========


http://aluigi.altervista.org/poc/strong2boom.zip


#######################################################################

======
4) Fix
======


No fix.
No reply from the vendor.


#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


Powered by blists - more mailing lists