lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-Id: <20080616224651.3b3c3a45.aluigi@autistici.org> Date: Mon, 16 Jun 2008 22:46:51 +0100 From: Luigi Auriemma <aluigi@...istici.org> To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk, packet@...ketstormsecurity.org, cert@...t.org, news@...uriteam.com Subject: NULL pointer in the HTTP/XML-RPC service of Crysis 1.21 ####################################################################### Luigi Auriemma Application: Crysis http://www.ea.com/crysis/home.jsp Versions: <= 1.21 (1.1.1.6156 showed as gamever) Platforms: Windows Bug: NULL pointer in the HTTP/XML-RPC service Exploitation: remote, versus server Date: 16 Jun 2008 Author: Luigi Auriemma e-mail: aluigi@...istici.org web: aluigi.org ####################################################################### 1) Introduction 2) Bug 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== Crysis is a recent FPS game developed by Crytek (http://www.crytek.com) and released at November 2007. This game is well known for being a "computer killer" due to its high hardware requirements but also for having various problems with cheaters. ####################################################################### ====== 2) Bug ====== Crysis has a small internal HTTP/XML-RPC server which must be activated with the http_startserver command (manually or through server.cfg) and allows to receive rcon commands. This service works on port 80 if no port is specified but usually the admins choose a custom port or just the same of the game (64087, the service is easily distinguishable due to the "Bad Request" title visible with a web browser). If an attacker uses an HTTP request with a total length major than 4096 bytes the server will crash due to a NULL pointer. ####################################################################### =========== 3) The Code =========== http://aluigi.org/poc/dontcrysis.txt nc SERVER HTTPPORT -v -v < dontcrysis.txt ####################################################################### ====== 4) Fix ====== No fix ####################################################################### --- Luigi Auriemma http://aluigi.org _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists