SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Game)  >   Halo Vendors:   Microsoft
Halo: Combat Evolved Off-by-One Error Lets Remote Deny Service
SecurityTracker Alert ID:  1011202
SecurityTracker URL:  http://securitytracker.com/id/1011202
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Sep 9 2004
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 1.4 and prior versions
Description:   Luigi Auriemma reported a denial of service vulnerability in the Halo: Combat Evolved game software. A remote user can cause the target server to crash.

It is reported that there is an off-by-one boundary error in the server in the processing of client response packets during the handshake. A remote user can send a value that is longer than 32 bytes to cause the game server to crash.

A demonstration exploit is available at:

http://aluigi.altervista.org/poc/haloboom.zip

Impact:   A remote user can cause the game server to crash.
Solution:   The vendor has issued a fix (Patch 1.05).
Vendor URL:  www.bungie.net/Games/HaloPC/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Apple (Legacy "classic" Mac), UNIX (macOS/OS X), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  Off-by-one bug in Halo 1.04



#######################################################################

                             Luigi Auriemma

Application:  Halo: Combat Evolved
              http://www.bungie.net/Games/HaloPC/
Versions:     <= 1.4
Platforms:    Windows and MacOS
Bug:          off-by-one (Denial of Service)
Risk:         medium/high
Exploitation: remote, versus server
Date:         09 September 2004
Author:       Luigi Auriemma
              e-mail: aluigi@altervista.org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Halo is the widely known game originally developed by Bungie Studios
and ported on PC by Gearbox Software (http://www.gearboxsoftware.com).
It has been released in September 2003.


#######################################################################

======
2) Bug
======


Halo uses the Gamespy SDK and moreover the handshake algorithm provided
in this library (http://aluigi.altervista.org/papers/gssdkcr.h) to let
players to join servers.

The off-by-one bug is located just in the client's response (the last
stage of this handshake) because if it is longer than 32 bytes causes
the immediate crash of the server.


#######################################################################

===========
3) The Code
===========


http://aluigi.altervista.org/poc/haloboom.zip


#######################################################################

======
4) Fix
======


Patch 1.05 for both Win32 and MacOS.


#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC