Battlefield Vietnam NULL Pointer Error Lets Remote Users Deny Service
|
|
SecurityTracker Alert ID: 1012448 |
|
SecurityTracker URL: http://securitytracker.com/id/1012448
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Dec 7 2004
|
Impact:
Denial of service via network
|
Fix Available: Yes Vendor Confirmed: Yes Exploit Included: Yes
|
Version(s): 1.2 and prior versions
|
Description:
Luigi Auriemma reported a vulnerability in Battlefield Vietnam. A remote user can cause the client to crash.
It is reported that the client does not properly validate the server-supplied 'numplayers' field. A large number can cause the client to freeze and then crash due to a NULL pointer access error.
A remote user visible in the master server list can cause all clients connected to the server to crash.
A demonstration exploit URL is provided:
http://aluigi.altervista.org/poc/bfcboom.zip
|
Impact:
A remote user can cause the target client to crash.
|
Solution:
The vendor has released a fixed version (1.21).
|
Vendor URL: www.dice.se/ (Links to External Site)
|
Cause:
Boundary error, Input validation error
|
Underlying OS:
UNIX (OS X), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 7 Dec 2004 17:26:45 +0000
Subject: Broadcast client crash in Battlefield 1942 1.6.19 and Vietnam 1.2
|
#######################################################################
Luigi Auriemma
Application: Battlefield 1942 and Vietnam
http://www.battlefield1942.com
Versions: Battlefield 1942 <= 1.6.19
Battlefield Vietnam <= 1.2
Platforms: Windows and Mac
Bug: client crash
Exploitation: remote, versus clients (broadcast)
Date: 07 December 2004
Author: Luigi Auriemma
e-mail: aluigi@autistici.org
web: http://aluigi.altervista.org
#######################################################################
1) Introduction
2) Bug
3) The Code
4) Fix
#######################################################################
===============
1) Introduction
===============
Battlefield 1942 and Vietnam are two of the most known and played FPS
games based on the relative military conflicts.
They are developed by Digital Illusions (http://www.dice.se) and have
been released respectively at September 2002 and March 2004.
#######################################################################
======
2) Bug
======
Like any multiplayer game, Battlefield contacts a master server to know
all the available online servers and then automatically queries them
to collect informations in the in-game browser.
The problem is in the parameter "numplayers" of the server's reply that
if is a too big number causes an immediate freeze of the client
followed (after some seconds) by a crash caused by the access to a NULL
pointer.
This is a broadcast client crash so a single attacker visible in the
master server list is able to passively exploit the bug versus any
vulnerable client online.
#######################################################################
===========
3) The Code
===========
http://aluigi.altervista.org/poc/bfcboom.zip
#######################################################################
======
4) Fix
======
Battlefield 1942 1.61b
Battlefield Vietnam 1.21
Note: this patch for Battlefield 1942 corrects, finally, also the known
bug in the old Gamespy cd-key SDK (aka gshboom, 24 February 2004)
used by the game and affecting the servers.
#######################################################################
---
Luigi Auriemma
http://aluigi.altervista.org
|
|
