Broadcast shutdown in Call of Duty 1.4
#######################################################################
Luigi Auriemma
Application: Call of Duty
http://www.callofduty.com
Versions: <= 1.4
Platforms: Windows and Linux
Bug: Denial of Service
Risk: high
Exploitation: remote, versus servers and clients (broadcast)
Date: 05 September 2004
Author: Luigi Auriemma
e-mail: aluigi@xxxxxxxxxxxxxx
web: http://aluigi.altervista.org
#######################################################################
1) Introduction
2) Bug
3) The Code
4) Fix
#######################################################################
===============
1) Introduction
===============
Call of Duty is the famous military FPS game developed by Infinity Ward
(http://www.infinityward.com) and released in October 2003.
An interesting note is that this security bug was already known by some
people since the release of my recent Medal of Honor buffer-overflow
(17 July 2004), in fact the same proof-of-concept works perfectly with
Call of Duty too.
#######################################################################
======
2) Bug
======
The game uses some anti-buffer-overflow checks that automatically
shutdown the game if they find a too big input.
The result is that a query or a reply containing over 1024 chars is
able to exploit this protection causing the immediate stop of the game.
Both servers and clients are vulnerables and the major problem is just
for clients because a single malicious server is able to passively stop
any client in the world so nobody can play online.
#######################################################################
===========
3) The Code
===========
http://aluigi.altervista.org/poc/codboom.zip
#######################################################################
======
4) Fix
======
Only the official patch for the Linux version is available (since some
weeks) and can be downloaded here:
http://www.icculus.org/betas/cod/
The Windows patch is not available and "probably" will be released at
the end of September.
In the meantime I have written an unofficial fix just for the 1.4 Win32
version of the game and is able to patch both clients and servers
because the function is the same:
http://aluigi.altervista.org/patches/cod-14-fix.zip
#######################################################################
---
Luigi Auriemma
http://aluigi.altervista.org