F.E.A.R. 1.01 likes lithsock

To: bugtraq@xxxxxxxxxxxxxxxxx, bugs@xxxxxxxxxxxxxxxxxxx, news@xxxxxxxxxxxxxx, full-disclosure@xxxxxxxxxxxxxxxxx, vuln@xxxxxxxxxxx
Subject: F.E.A.R. 1.01 likes lithsock
From: Luigi Auriemma <aluigi@xxxxxxxxxxxxx>
Date: Fri, 21 Oct 2005 18:21:36 +0200
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm

F.E.A.R. (First Encounter Assault and Recon, http://www.whatisfear.com)
is the recent FPS game developed by Monolith.

I knew it was vulnerable from many months but I was really curious to
see if the developers were so brave to leave this old "silent socket
termination" bug unpatched not only in the retail game released in
October but also in the 1.01 patch released just 4 days ago.

The original advisory and proof-of-concept I released in the far December
2004 are available here:

  http://aluigi.altervista.org/adv/lithsock-adv.txt
  http://aluigi.altervista.org/poc/lithsock.zip


--- 
Luigi Auriemma 
http://aluigi.altervista.org

Prev by Date: MDKSA-2005:188 - Updated graphviz packages fix temporary file vulnerability.
Next by Date: Nuked klan 1.7: XSS vulnerability
Previous by thread: MDKSA-2005:188 - Updated graphviz packages fix temporary file vulnerability.
Next by thread: Nuked klan 1.7: XSS vulnerability
Index(es):
- Date
- Thread