Crysis HTTP/XML-RPC Service Remote Denial of Service Vulnerability

Bugtraq ID:	29759
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2008-6712
Remote:	Yes
Local:	No
Published:	Jun 16 2008 12:00AM
Updated:	May 07 2015 05:28PM
Credit:	Luigi Auriemma
Vulnerable:	Electronic Arts Inc. Crysis 1.21
Not Vulnerable:

Crysis HTTP/XML-RPC Service Remote Denial of Service Vulnerability

Crysis is prone to a remote denial-of-service vulnerability because the application fails to handle exceptional conditions.

An attacker can exploit this issue to crash the affected application, denying further service to legitimate users.

Crysis 1.21 is vulnerable; other versions may also be affected.

Crysis HTTP/XML-RPC Service Remote Denial of Service Vulnerability

An attacker can exploit this issue by using standard network utilities.

The following command and proof-of-concept HTTP request are available:

nc SERVER HTTPPORT -v -v < dontcrysis.txt

• /data/vulnerabilities/exploits/dontcrysis.txt

Crysis HTTP/XML-RPC Service Remote Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Crysis HTTP/XML-RPC Service Remote Denial of Service Vulnerability

References:

• Crysis Homepage (Crytek)
  
• NULL pointer in the HTTP/XML-RPC service of Crysis 1.21 (Luigi Auriemma )
  
• NULL pointer in the HTTP/XML-RPC service (Luigi Auriemma)