[NT] Warrior Kings: Battles Fromat String
SecuriTeam <[email protected]>
| Newsgroups | gmane.comp.security.securiteam |
|---|---|
| Message-ID | <[email protected]> |
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source. http://www.securiteam.com/mailinglist.html - - - - - - - - - Warrior Kings: Battles Fromat String ------------------------------------------------------------------------ SUMMARY Warrior Kings: Battles is "a real-time strategy game developed by Black Cactus (http://www.blackcactus.co.uk) and released in March 2003. The game is published by Empire Interactive and Strategy First. Warrior Kings instead is published by Microids and Empire Interactive and has been released exactly one year before its successor". A format string vulnerability exists in Warrior Kings and its successor Warrior Kings: Battles, exploiting this vulnerability allows arbitrary code execution on vulnerable game server. DETAILS Vulnerable Systems: * Warrior Kings: Battles version 1.23 and prior * Warrior Kings version 1.3 and prior The game is affected by a format string bug in the function used to visualize the text on the screen. The best and simplest way to exploit the bug is through a malformed nickname. The only limitation is that the attacker cannot exploit the bug if the server is locked. A partial join packet causes the crash of the server due to the access to a NULL pointer. Only Warrior Kings Battles seems affected by this problem. Proof of concepts: <http://aluigi.altervista.org/poc/wkbbugs.zip> http://aluigi.altervista.org/poc/wkbbugs.zip <http://aluigi.altervista.org/poc/warkingsfs.zip> http://aluigi.altervista.org/poc/warkingsfs.zip ADDITIONAL INFORMATION The information has been provided by <mailto:[email protected]> Luigi Auriemma. The original article can be found at: <http://aluigi.altervista.org> http://aluigi.altervista.org ======================================== This bulletin is sent to members of the SecuriTeam mailing list. To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] In order to subscribe to the mailing list, simply forward this email to: [email protected] ==================== ==================== DISCLAIMER: The information in this bulletin is provided "AS IS" without warranty of any kind. In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.