SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Game)  >   Battlefield Vietnam Vendors:   Digital Illusions
Battlefield Vietnam NULL Pointer Error Lets Remote Users Deny Service
SecurityTracker Alert ID:  1012448
SecurityTracker URL:  http://securitytracker.com/id/1012448
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Dec 7 2004
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 1.2 and prior versions
Description:   Luigi Auriemma reported a vulnerability in Battlefield Vietnam. A remote user can cause the client to crash.

It is reported that the client does not properly validate the server-supplied 'numplayers' field. A large number can cause the client to freeze and then crash due to a NULL pointer access error.

A remote user visible in the master server list can cause all clients connected to the server to crash.

A demonstration exploit URL is provided:

http://aluigi.altervista.org/poc/bfcboom.zip

Impact:   A remote user can cause the target client to crash.
Solution:   The vendor has released a fixed version (1.21).
Vendor URL:  www.dice.se/ (Links to External Site)
Cause:   Boundary error, Input validation error
Underlying OS:  UNIX (macOS/OS X), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  Broadcast client crash in Battlefield 1942 1.6.19 and Vietnam 1.2



#######################################################################

                             Luigi Auriemma

Application:  Battlefield 1942 and Vietnam
              http://www.battlefield1942.com
Versions:     Battlefield 1942    <= 1.6.19
              Battlefield Vietnam <= 1.2
Platforms:    Windows and Mac
Bug:          client crash
Exploitation: remote, versus clients (broadcast)
Date:         07 December 2004
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Battlefield 1942 and Vietnam are two of the most known and played FPS
games based on the relative military conflicts.
They are developed by Digital Illusions (http://www.dice.se) and have
been released respectively at September 2002 and March 2004.


#######################################################################

======
2) Bug
======


Like any multiplayer game, Battlefield contacts a master server to know
all the available online servers and then automatically queries them
to collect informations in the in-game browser.

The problem is in the parameter "numplayers" of the server's reply that
if is a too big number causes an immediate freeze of the client
followed (after some seconds) by a crash caused by the access to a NULL
pointer.

This is a broadcast client crash so a single attacker visible in the
master server list is able to passively exploit the bug versus any
vulnerable client online.


#######################################################################

===========
3) The Code
===========


http://aluigi.altervista.org/poc/bfcboom.zip


#######################################################################

======
4) Fix
======


Battlefield 1942    1.61b
Battlefield Vietnam 1.21

Note: this patch for Battlefield 1942 corrects, finally, also the known
      bug in the old Gamespy cd-key SDK (aka gshboom, 24 February 2004)
      used by the game and affecting the servers.


#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC