Gamespy Software Development Kit CD-Key Validation Buffer Overflow Vulnerability

Bugtraq ID:	11881
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 10 2004 12:00AM
Updated:	Dec 10 2004 12:00AM
Credit:	Luigi Auriemma <[email protected]> disclosed this vulnerability.
Vulnerable:	GameSpy Software Development Kit + 4D Rulers Gore + Activision Starfleet Command III + Atari Terminator 3: War Of The Machines + Brat Designs Breed + Digital Reality Haegemonia 1.0.7 + Digital Reality Haegemonia 1.0.5 + Digital Reality Haegemonia 1.0.4 + Digital Reality Haegemonia 1.0 + DreamCatcher Gore Ultimate Soldier + Electronic Arts Inc. Armies of Exigo + Electronic Arts Inc. Battlefield 1942 1.3 + Electronic Arts Inc. Battlefield 1942 1.2 + Electronic Arts Inc. Need For Speed: Hot Pursuit 2 + Gearbox Software Halo Combat Evolved 1.31 + Gearbox Software Halo Combat Evolved 1.5 + Gearbox Software Halo Combat Evolved 1.4 + Gearbox Software Halo Combat Evolved 1.2 + Gearbox Software Halo Combat Evolved 1.06 + Global Star Software Hidden & Dangerous 2 + Illusion Softworks Hidden & Dangerous 2 + LucasArts Star Wars Battlefront 1.11 + LucasArts Start Wars Republic Commando + Microsoft Halo - Combat Evolved + Monolith Productions Tron 2.0 1.0 + Pan Vision I.G.I-2 Covert Strike 1.3 + Pan Vision I.G.I-2 Covert Strike 1.2 + Pan Vision I.G.I-2 Covert Strike 1.1 + Pan Vision I.G.I-2 Covert Strike 1.0 + People can Fly Painkiller 1.3.1 + Sierra Entertainment Contract Jack 1.1 + Sierra Entertainment Contract Jack 1.0 + Sierra Entertainment Men of Valor + Sierra Entertainment Tribes: Vengeance + TimeGate Studios Axis & Allies + TimeGate Studios Kohan II + Vivendi Universal Judge Dredd: Dredd vs. Death
Not Vulnerable:

Gamespy Software Development Kit CD-Key Validation Buffer Overflow Vulnerability

It has been reported that the GameSpy SDK is prone to a buffer overflow vulnerability in its CD-key validation functionality. This issue is due to a failure of the SDK to properly check the length of user-supplied network data prior to copying it to a fixed-sized memory buffer.

Exploitation of this issue may allow attackers to execute arbitrary machine code in the context of the affected GameSpy developed game.

Gamespy Software Development Kit CD-Key Validation Buffer Overflow Vulnerability

A proof of concept exploit is provided:

• /data/vulnerabilities/exploits/goregsbof.zip

Gamespy Software Development Kit CD-Key Validation Buffer Overflow Vulnerability

Solution:
It is reported that the affected SDK has been fixed 19 November 2004, but this has not been confirmed by the vendor. Individual games utilizing the SDK also have to be fixed, and Symantec is currently unaware of vendor-supplied patches. This BID will be updated as further information is disclosed.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Gamespy Software Development Kit CD-Key Validation Buffer Overflow Vulnerability

References:

• Vendor Home Page (GameSpy)
  
• In-game buffer-overflow in the Gamespy cd-key validation SDK (Luigi Auriemma )