full-disclosure - Crash in Lords of the Realm III 1.01

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20040919215254.2ab7ae13.aluigi@autistici.org>
From: aluigi at autistici.org (Luigi Auriemma)
Subject: Crash in Lords of the Realm III 1.01

#######################################################################

                             Luigi Auriemma

Application:  Lords of the Realm III
              http://www.lords3.com
Versions:     <= 1.01
Platforms:    Windows
Bug:          crash
Risk:         low/medium
Exploitation: remote, versus server
Date:         19 September 2004
Author:       Luigi Auriemma
              e-mail: aluigi@...ervista.org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Lords of the Realm III is a strategic game developed by Impressions
Games (http://www.impressionsgames.com) and released in March 2004.


#######################################################################

======
2) Bug
======


The problem is located in the length of the user's nickname, in fact if
it is too long the server will try to write to an unallocated zone of
the memory.

The bug can be exploited only when the server is in the lobby stage (so
when users can join it) because it is the only moment that it accepts
connections.


#######################################################################

===========
3) The Code
===========


http://aluigi.altervista.org/poc/lotr3boom.zip


#######################################################################

======
4) Fix
======


No fix.
Doesn't exist an e-mail address to directly contact the developers...


#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org