Gamespy Software Development Kit Remote Denial Of Service Vulnerability

Bugtraq ID:	9741
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Feb 24 2004 12:00AM
Updated:	Feb 24 2004 12:00AM
Credit:	Disclosure of this issue is credited to Luigi Auriemma <[email protected]>.
Vulnerable:	GameSpy Software Development Kit + 4D Rulers Gore + Activision Starfleet Command III + Atari Terminator 3: War Of The Machines + Brat Designs Breed + Digital Reality Haegemonia 1.0.7 + Digital Reality Haegemonia 1.0.5 + Digital Reality Haegemonia 1.0.4 + Digital Reality Haegemonia 1.0 + DreamCatcher Gore Ultimate Soldier + Electronic Arts Inc. Armies of Exigo + Electronic Arts Inc. Battlefield 1942 1.3 + Electronic Arts Inc. Battlefield 1942 1.2 + Electronic Arts Inc. Need For Speed: Hot Pursuit 2 + Gearbox Software Halo Combat Evolved 1.31 + Gearbox Software Halo Combat Evolved 1.5 + Gearbox Software Halo Combat Evolved 1.4 + Gearbox Software Halo Combat Evolved 1.2 + Gearbox Software Halo Combat Evolved 1.06 + Global Star Software Hidden & Dangerous 2 + Illusion Softworks Hidden & Dangerous 2 + LucasArts Star Wars Battlefront 1.11 + LucasArts Start Wars Republic Commando + Microsoft Halo - Combat Evolved + Monolith Productions Tron 2.0 1.0 + Pan Vision I.G.I-2 Covert Strike 1.3 + Pan Vision I.G.I-2 Covert Strike 1.2 + Pan Vision I.G.I-2 Covert Strike 1.1 + Pan Vision I.G.I-2 Covert Strike 1.0 + People can Fly Painkiller 1.3.1 + Sierra Entertainment Contract Jack 1.1 + Sierra Entertainment Contract Jack 1.0 + Sierra Entertainment Men of Valor + Sierra Entertainment Tribes: Vengeance + TimeGate Studios Axis & Allies + TimeGate Studios Kohan II + Vivendi Universal Judge Dredd: Dredd vs. Death
Not Vulnerable:

Gamespy Software Development Kit Remote Denial Of Service Vulnerability

It has been reported that the GameSpy SDK is prone to a remote denial of service vulnerability. This issue is due to the software failing to handle exceptional conditions during network communication.

Exploitation of this issue may cause the affected GameSpy developed game to crash, denying service to legitimate users.

Gamespy Software Development Kit Remote Denial Of Service Vulnerability

The following exploit has been provided:

• /data/vulnerabilities/exploits/gshboom.zip

Gamespy Software Development Kit Remote Denial Of Service Vulnerability

Solution:
It has been reported that the vendor has released a patched version of the SDK. Please see the reference section for the vendor site and details on obtaining fixes.

Gamespy Software Development Kit Remote Denial Of Service Vulnerability

References:

• Vendor Home Page (GameSpy)
  
• Hidden Gamespy code leads to vulnerabilities in diffused games (Luigi Auriemma )