Call of Duty Game Can Be Shutdown By Remote Users
|
|
SecurityTracker Alert ID: 1011165 |
|
SecurityTracker URL: http://securitytracker.com/id/1011165
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Sep 5 2004
|
Impact:
Denial of service via network
|
Fix Available: Yes Vendor Confirmed: Yes Exploit Included: Yes
|
Version(s): 1.4 and prior versions
|
Description:
Luigi Auriemma reported a vulnerability in the Call of Duty game software. A remote user can cause the game service to shutdown.
It is reported that a remote user can send a query or a reply with more than 1024 characters to cause the game to shutdown due to buffer overflow protections in the game.
Clients and servers are affected. A malicious server can cause all clients to shutdown.
Some demonstration exploit code is available at:
http://aluigi.altervista.org/poc/codboom.zip
|
Impact:
A remote user can cause the target game to shutdown.
|
Solution:
A patch for the Linux version is available at:
http://www.icculus.org/betas/cod/
The vendor is reportedly working on a patch for the Windows version.
The author of the report has written an unofficial fix for the 1.4 Windows version, available at:
http://aluigi.altervista.org/patches/cod-14-fix.zip
|
Vendor URL: www.infinityward.com/ (Links to External Site)
|
Cause:
Exception handling error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Sun, 5 Sep 2004 17:02:06 +0000
Subject: Broadcast shutdown in Call of Duty 1.4
|
#######################################################################
Luigi Auriemma
Application: Call of Duty
http://www.callofduty.com
Versions: <= 1.4
Platforms: Windows and Linux
Bug: Denial of Service
Risk: high
Exploitation: remote, versus servers and clients (broadcast)
Date: 05 September 2004
Author: Luigi Auriemma
e-mail: aluigi@altervista.org
web: http://aluigi.altervista.org
#######################################################################
1) Introduction
2) Bug
3) The Code
4) Fix
#######################################################################
===============
1) Introduction
===============
Call of Duty is the famous military FPS game developed by Infinity Ward
(http://www.infinityward.com) and released in October 2003.
An interesting note is that this security bug was already known by some
people since the release of my recent Medal of Honor buffer-overflow
(17 July 2004), in fact the same proof-of-concept works perfectly with
Call of Duty too.
#######################################################################
======
2) Bug
======
The game uses some anti-buffer-overflow checks that automatically
shutdown the game if they find a too big input.
The result is that a query or a reply containing over 1024 chars is
able to exploit this protection causing the immediate stop of the game.
Both servers and clients are vulnerables and the major problem is just
for clients because a single malicious server is able to passively stop
any client in the world so nobody can play online.
#######################################################################
===========
3) The Code
===========
http://aluigi.altervista.org/poc/codboom.zip
#######################################################################
======
4) Fix
======
Only the official patch for the Linux version is available (since some
weeks) and can be downloaded here:
http://www.icculus.org/betas/cod/
The Windows patch is not available and "probably" will be released at
the end of September.
In the meantime I have written an unofficial fix just for the 1.4 Win32
version of the game and is able to patch both clients and servers
because the function is the same:
http://aluigi.altervista.org/patches/cod-14-fix.zip
#######################################################################
---
Luigi Auriemma
http://aluigi.altervista.org
|
|
