2K Games Vietcong 2 'CNS_AddTxt()' Format String Vulnerability

Bugtraq ID:	43129
Class:	Input Validation Error
CVE:	CVE-2009-2916
Remote:	Yes
Local:	No
Published:	Aug 12 2009 12:00AM
Updated:	Aug 12 2009 12:00AM
Credit:	Luigi Auriemma
Vulnerable:	2K Games Vietcong 2 1.10
Not Vulnerable:

2K Games Vietcong 2 'CNS_AddTxt()' Format String Vulnerability

2K Games Vietcong 2 is prone to a format-string vulnerability because it fails to properly sanitize user-supplied data.

Exploiting this issue will allow an attacker to execute arbitrary code in the context of the application, or cause denial-of-service conditions.

2K Games Vietcong 2 1.10 and prior are vulnerable.

2K Games Vietcong 2 'CNS_AddTxt()' Format String Vulnerability

The following proofs of concept is available:

• /data/vulnerabilities/exploits/43129.zip

2K Games Vietcong 2 'CNS_AddTxt()' Format String Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

2K Games Vietcong 2 'CNS_AddTxt()' Format String Vulnerability

References:

• Vietcong 2 Format String (Luigi Auriemma)
  
• Vietcong 2 Homepage (2K Sports)