The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Call Of Duty Broadcast Shutdown DoS Vulnerability
------------------------------------------------------------------------
SUMMARY
<http://www.callofduty.com> Call of Duty is the famous military FPS game
developed by Infinity Ward and released in October 2003.
The game uses special measures in its code to prevent buffer overflows.
These measures shutdown the game whenever large input is received,
enabling a remote denial-of-service attack against the player.
DETAILS
Vulnerable Systems:
* Call of Duty version 1.4
The game uses some anti-buffer-overflow checks that automatically shutdown
the game if they receive an input which is too long. The result is that a
query or a reply containing over 1024 chars is able to exploit this
protection causing the immediate shutdown of the game on the receiving
end.
Both servers and clients are vulnerable to this issue. However, a server
can exploit this issue passively with every client that is connecting,
thus rendering gameplay impossible.
A sample proof of concept code is available for download at
<http://aluigi.altervista.org/poc/codboom.zip>
http://aluigi.altervista.org/poc/codboom.zip.
Patch Availability:
The only official patch available is for the Linux version of the game. It
can be found at <http://www.icculus.org/betas/cod/>
http://www.icculus.org/betas/cod/.
The patch for the Windows version of the game is scheduled to be released
at the end of September.
An unofficial patch by Luigi is provided as well, for both versions -
<http://aluigi.altervista.org/patches/cod-14-fix.zip>
http://aluigi.altervista.org/patches/cod-14-fix.zip.
ADDITIONAL INFORMATION
The information has been provided by <mailto:aluigi@autistici.org> Luigi
Auriemma.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
