- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
World in Conflict NULL Pointer Crash
------------------------------------------------------------------------
SUMMARY
The World in Conflict server is vulneable to a Denial of Service attack
(crash) caused by the access to a NULL pointer. The problem happens in the
GetMagicNumberString function which takes the third byte of the data
received from the client on the VOIP port 52999 and returns a text string
if this value is valid ("ABC" for type 0, "DEF" for 1, "GHI" for 2 and so
on) or NULL if it's invalid. Then the string returned by this function is
compared with another one and here happens the NULL pointer access.
DETAILS
Vulnerable Systems:
* World in Conflict version 1.000 and prior
Immune Systems:
* World in Conflict version 1.00
Exploit:
Connect to the VOIP port of the server (default 52999) with telnet or
netcat and type something like aaaaaaa. The server will crash immediately.
ADDITIONAL INFORMATION
The information has been provided by <mailto:aluigi@autistici.org> Luigi
Auriemma.
The original article can be found at:
<http://aluigi.altervista.org/adv/wicvoipnull-adv.txt>
http://aluigi.altervista.org/adv/wicvoipnull-adv.txt
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
No comments:
Post a Comment