#######################################################################
Luigi Auriemma
Application: Stronghold 2
http://www.stronghold2.com
Versions: <= 1.2
Platforms: Windows
Bug: exception/crash
Exploitation: remote, versus server
Date: 30 May 2005
Author: Luigi Auriemma
e-mail: aluigi@autistici.org
web: http://aluigi.altervista.org
#######################################################################
1) Introduction
2) Bug
3) The Code
4) Fix
#######################################################################
===============
1) Introduction
===============
Stronghold 2 is a stategic game developed by Firefly Studios
(http://www.fireflyworlds.com) and published by 2K Games
(http://www.2kgames.com).
It has been released in April 2005.
#######################################################################
======
2) Bug
======
In the packet used for joining the server is locatd the client's
nickname preceded by a 32 bit number used to specify its size.
When the server receives the packet it reads this number and allocates
that amount of memory where, then, will be copied the nickname.
The problem is that the STLport library fails to allocate a too big
amount of memory and generates an exception that terminates the game.
#######################################################################
===========
3) The Code
===========
http://aluigi.altervista.org/poc/strong2boom.zip
#######################################################################
======
4) Fix
======
No fix.
No reply from the vendor.
#######################################################################
---
Luigi Auriemma
http://aluigi.altervista.org
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
