SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Game)  >   Call of Duty Vendors:   Infinity Ward
Call of Duty Game Can Be Shutdown By Remote Users
SecurityTracker Alert ID:  1011165
SecurityTracker URL:  http://securitytracker.com/id/1011165
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Sep 5 2004
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 1.4 and prior versions
Description:   Luigi Auriemma reported a vulnerability in the Call of Duty game software. A remote user can cause the game service to shutdown.

It is reported that a remote user can send a query or a reply with more than 1024 characters to cause the game to shutdown due to buffer overflow protections in the game.

Clients and servers are affected. A malicious server can cause all clients to shutdown.

Some demonstration exploit code is available at:

http://aluigi.altervista.org/poc/codboom.zip

Impact:   A remote user can cause the target game to shutdown.
Solution:   A patch for the Linux version is available at:

http://www.icculus.org/betas/cod/

The vendor is reportedly working on a patch for the Windows version.

The author of the report has written an unofficial fix for the 1.4 Windows version, available at:

http://aluigi.altervista.org/patches/cod-14-fix.zip

Vendor URL:  www.infinityward.com/ (Links to External Site)
Cause:   Exception handling error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  Broadcast shutdown in Call of Duty 1.4



#######################################################################

                             Luigi Auriemma

Application:  Call of Duty
              http://www.callofduty.com
Versions:     <= 1.4
Platforms:    Windows and Linux
Bug:          Denial of Service
Risk:         high
Exploitation: remote, versus servers and clients (broadcast)
Date:         05 September 2004
Author:       Luigi Auriemma
              e-mail: aluigi@altervista.org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Call of Duty is the famous military FPS game developed by Infinity Ward
(http://www.infinityward.com) and released in October 2003.

An interesting note is that this security bug was already known by some
people since the release of my recent Medal of Honor buffer-overflow
(17 July 2004), in fact the same proof-of-concept works perfectly with
Call of Duty too.


#######################################################################

======
2) Bug
======


The game uses some anti-buffer-overflow checks that automatically
shutdown the game if they find a too big input.

The result is that a query or a reply containing over 1024 chars is
able to exploit this protection causing the immediate stop of the game.

Both servers and clients are vulnerables and the major problem is just
for clients because a single malicious server is able to passively stop
any client in the world so nobody can play online.


#######################################################################

===========
3) The Code
===========


http://aluigi.altervista.org/poc/codboom.zip


#######################################################################

======
4) Fix
======


Only the official patch for the Linux version is available (since some
weeks) and can be downloaded here:

  http://www.icculus.org/betas/cod/

The Windows patch is not available and "probably" will be released at
the end of September.

In the meantime I have written an unofficial fix just for the 1.4 Win32
version of the game and is able to patch both clients and servers
because the function is the same:

  http://aluigi.altervista.org/patches/cod-14-fix.zip


#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC