Roger Wilco Remote Username Denial of Service Vulnerability
BID:8568
Info
Roger Wilco Remote Username Denial of Service Vulnerability
| Bugtraq ID: | 8568 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 08 2003 12:00AM |
| Updated: | Sep 08 2003 12:00AM |
| Credit: | The discovery of this vulnerability has been credited to Luigi Auriemma <[email protected]>. |
| Vulnerable: |
GameSpy Roger Wilco Graphical Server 1.4.1 .6 |
| Not Vulnerable: | |
Discussion
Roger Wilco Remote Username Denial of Service Vulnerability
It has been reported that connecting to a Roger Wilco server with a username of excessive length may cause the server to crash. The problem is said to specifically occur when someone with a 33 byte or larger username connects to the server. This may effectively deny service to other legitimate users.
It has been reported that connecting to a Roger Wilco server with a username of excessive length may cause the server to crash. The problem is said to specifically occur when someone with a 33 byte or larger username connects to the server. This may effectively deny service to other legitimate users.
Exploit / POC
Roger Wilco Remote Username Denial of Service Vulnerability
No exploit is required. It may however be required to modify the client program to allow for 33 byte or larger usernames.
Luigi Auriemma <[email protected]> has supplied a proof of concept exploit 'wilco.zip' available at the following location:
http://www.zone-h.org/download/file=5019/
No exploit is required. It may however be required to modify the client program to allow for 33 byte or larger usernames.
Luigi Auriemma <[email protected]> has supplied a proof of concept exploit 'wilco.zip' available at the following location:
http://www.zone-h.org/download/file=5019/
Solution / Fix
Roger Wilco Remote Username Denial of Service Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Roger Wilco Remote Username Denial of Service Vulnerability
References:
References:
- Roger Wilco Home Page (GameSpy)
- Rogerwilco 1.4.1.2 and 1.4.1.6 remix of bugs (Luigi Auriemma