Half-Life Invalid Command Error Response Format String Vulnerability
BID:8730
Info
Half-Life Invalid Command Error Response Format String Vulnerability
| Bugtraq ID: | 8730 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 29 2003 12:00AM |
| Updated: | Sep 29 2003 12:00AM |
| Credit: | This vulnerability was reported by Luigi Auriemma. |
| Vulnerable: |
Valve Software Half-Life 1.1.1 .0 Valve Software Half-Life 1.1 .0.9 Valve Software Half-Life 1.1 .0.8 Valve Software Half-Life 1.1 .0.4 Windows |
| Not Vulnerable: | |
Discussion
Half-Life Invalid Command Error Response Format String Vulnerability
It has been reported that Half-Life clients may be prone to a format string vulnerability. The problem occurs when an invalid command is issued to the server, and an error response is returned and displayed by the client. If a format specifier were included within the invalid command, when displaying the error the format specifier would be interperted literally. This could potentially be exploited by a remote attacker to execute arbitrary code with the privileges of the Half-Life client.
It has been reported that Half-Life clients may be prone to a format string vulnerability. The problem occurs when an invalid command is issued to the server, and an error response is returned and displayed by the client. If a format specifier were included within the invalid command, when displaying the error the format specifier would be interperted literally. This could potentially be exploited by a remote attacker to execute arbitrary code with the privileges of the Half-Life client.
Exploit / POC
Half-Life Invalid Command Error Response Format String Vulnerability
A tool has been released by Luigi Auriemma that is designed to demonstrate the issue on vulnerable clients. However, currently we are not aware of any exploits for this issue.
A tool has been released by Luigi Auriemma that is designed to demonstrate the issue on vulnerable clients. However, currently we are not aware of any exploits for this issue.
Solution / Fix
Half-Life Invalid Command Error Response Format String Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Half-Life Invalid Command Error Response Format String Vulnerability
References:
References:
- Format string bug in Half-Life client, but is it really exploitable??? (Luigi Auriemma)
- Valve Software Homepage (Valve Software)