Gamespy 3d IRC Client Remote Buffer Overflow Vulnerability
BID:8734
Info
Gamespy 3d IRC Client Remote Buffer Overflow Vulnerability
| Bugtraq ID: | 8734 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 30 2003 12:00AM |
| Updated: | Sep 30 2003 12:00AM |
| Credit: | The disclosure of this issue has been credited to Luigi Auriemma <[email protected]>. |
| Vulnerable: |
GameSpy GameSpy 3D 2.63 015 GameSpy GameSpy 3D 2.62 |
| Not Vulnerable: | |
Discussion
Gamespy 3d IRC Client Remote Buffer Overflow Vulnerability
It has been reported that Gamespy 3D IRC client may be prone to a remote buffer overflow vulnerability due to insufficient boundary checking. The issue is reported to present itself when the client attempts to connect to a remote IRC server. During the connection process the client is reported to a send USER and NICK requests to the server. A buffer overflow condition may occur if the server responds with a request that is larger than or equal to 262 bytes.
Successful exploitation of this issue may allow an attacker to execute arbitrary code in the context of the client in order to gain unauthorized access to a vulnerable system.
Gamespy 3D versions 2.63015 and prior have been reported to be prone to this issue, however other versions may be affected as well.
It has been reported that Gamespy 3D IRC client may be prone to a remote buffer overflow vulnerability due to insufficient boundary checking. The issue is reported to present itself when the client attempts to connect to a remote IRC server. During the connection process the client is reported to a send USER and NICK requests to the server. A buffer overflow condition may occur if the server responds with a request that is larger than or equal to 262 bytes.
Successful exploitation of this issue may allow an attacker to execute arbitrary code in the context of the client in order to gain unauthorized access to a vulnerable system.
Gamespy 3D versions 2.63015 and prior have been reported to be prone to this issue, however other versions may be affected as well.
Exploit / POC
Gamespy 3d IRC Client Remote Buffer Overflow Vulnerability
The following proof of concept was provided:
You can use a text file containing a long string and launching netcat in
listening mode:
nc -l -p 6667 -v -v -n < long_string.txt
Proof of concept code may be downloaded from the following location:
http://aluigi.altervista.org/poc/gs3dirc.zip
The following proof of concept was provided:
You can use a text file containing a long string and launching netcat in
listening mode:
nc -l -p 6667 -v -v -n < long_string.txt
Proof of concept code may be downloaded from the following location:
http://aluigi.altervista.org/poc/gs3dirc.zip
Solution / Fix
Gamespy 3d IRC Client Remote Buffer Overflow Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Gamespy 3d IRC Client Remote Buffer Overflow Vulnerability
References:
References:
- GameSpy 3D Home Page (GameSpy)
- Gamespy3d <= 263015 lets code execution through long IRC answer (Luigi Auriemma