full-disclosure-uk August 2008 archive
Main Archive Page > Month Archives  > full-disclosure-uk archives
full-disclosure-uk: [Full-disclosure] Server termination in Amer

[Full-disclosure] Server termination in America's Army 2.8.3.1

From: Luigi Auriemma <aluigi_at_nospam>
Date: Sat Aug 02 2008 - 18:15:17 GMT
To: bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk, packet@packetstormsecurity.org, cert@cert.org, news@securiteam.com

#######################################################################
Luigi Auriemma Applications: America's Army http://www.americasarmy.com Versions: <= 2.8.3.1 Platforms: Windows (tested), Linux and Mac Bug: server termination due to failed assertion Exploitation: remote, versus server Date: 02 Aug 2008 Author: Luigi Auriemma e-mail: aluigi@autistici.org web: aluigi.org
#######################################################################
1) Introduction 2) Bug
3) The Code
4) Fix

#######################################################################


  1. Introduction

>From Wikipedia:
"America's Army (also known as AA or Army Game Project) is a tactical multiplayer first-person shooter owned by the United States Government and released as a global public relations initiative to help with U.S. Army recruitment."

#######################################################################



2) Bug

The AA server can be terminated remotely through a specific single spoofable UDP packet which leads to a failed assertion:

  "Assertion failed: VoiceIndex<VOICE_MAX_CHATTERS"

Note: this bug is the same I found and disclosed in Unreal Tournament 2004 some days ago and which affects some other games too (ut2004null).

#######################################################################



3) The Code

http://aluigi.org/poc/armynchia.zip

#######################################################################



4) Fix

No fix

#######################################################################

---
Luigi Auriemma http://aluigi.org http://backup.aluigi.org http://mirror.aluigi.org _______________________________________________ Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/