aGSM Half-Life Server Info Response Buffer Overflow Vulnerability
BID:10989
Info
aGSM Half-Life Server Info Response Buffer Overflow Vulnerability
| Bugtraq ID: | 10989 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 20 2004 12:00AM |
| Updated: | Aug 20 2004 12:00AM |
| Credit: | Discovery of this vulnerability is credited to Dmitriy 'Dimetrius' Baranov. |
| Vulnerable: |
aGSM aGSM 2.35 c |
| Not Vulnerable: | |
Discussion
aGSM Half-Life Server Info Response Buffer Overflow Vulnerability
aGSM is reported prone to a remote buffer overflow vulnerability. The issue presents itself in the aGSM server information parsing routines for Half-Life game servers. Due to a lack of sufficient bounds checking performed on the hostname parameter in a server reply to an info request, a malicious server may execute arbitrary code on an affected client.
It should be noted that although aGSM version 2.35c is reported prone to this vulnerability, other versions might also be affected.
aGSM is reported prone to a remote buffer overflow vulnerability. The issue presents itself in the aGSM server information parsing routines for Half-Life game servers. Due to a lack of sufficient bounds checking performed on the hostname parameter in a server reply to an info request, a malicious server may execute arbitrary code on an affected client.
It should be noted that although aGSM version 2.35c is reported prone to this vulnerability, other versions might also be affected.
Exploit / POC
aGSM Half-Life Server Info Response Buffer Overflow Vulnerability
The following example is available:
For the following query:
\xFF\xFF\xFF\xFFinfo\x00
The following response is sent:
\xff\xff\xff\xffA\x00AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
The following example is available:
For the following query:
\xFF\xFF\xFF\xFFinfo\x00
The following response is sent:
\xff\xff\xff\xffA\x00AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
aGSM Half-Life Server Info Response Buffer Overflow Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
aGSM Half-Life Server Info Response Buffer Overflow Vulnerability
References:
References:
- aGsm 2.35c (Dmitriy 'Dimetrius' Baranov
- aGSM Homepage (aGSM)