GameSpy 3D Packet Amplification Denial Of Service Vulnerability

Bugtraq ID:	6636
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 17 2003 12:00AM
Updated:	Jan 17 2003 12:00AM
Credit:	Discovery of this vulnerability credited to Mike Kristovich <[email protected]>.
Vulnerable:	GameSpy GameSpy 3D 2.62
Not Vulnerable:

GameSpy 3D Packet Amplification Denial Of Service Vulnerability

A vulnerability has been reported for several games that support the use of the GameSpy network.

A game client typically queries a game server using the UDP protocol. It has been reported that a simple query by a client may result in a game server responding with overly large responses which may result in the saturation of available network bandwidth.

Exploitation of this issue may aid in launching denial of service attacks against other hosts and networks.

GameSpy 3D Packet Amplification Denial Of Service Vulnerability

The following exploit was provided:

• /data/vulnerabilities/exploits/bf1942dos.c

GameSpy 3D Packet Amplification Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

GameSpy 3D Packet Amplification Denial Of Service Vulnerability

References:

• GameSpy 3D Home Page (GameSpy)