#######################################################################                              Luigi Auriemma Applications: Call of Duty                     <= 1.5b               Call of Duty: United Offensive   <= 1.51b               http://www.callofduty.com Platforms:    Windows only (Linux is safe and Mac has not been tested) Bug:          crash Exploitation: remote, versus server (in-game) Date:         02 Apr 2005 Author:       Luigi Auriemma               e-mail: This e-mail address is being protected from spam bots, you need JavaScript enabled to view it               web:    http://aluigi.altervista.org ####################################################################### 1) Introduction 2) Bug 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== Call of Duty and its expansion pack United Offensive are the famous military FPS games developed by Infinity Ward (http://www.infinityward.com) and Gray Matter Studios (http://www.gmistudios.com). The games have been released respectively in October 2003 and September 2004. ####################################################################### ====== 2) Bug ====== The game server is affected by a problem in the building of the commands to visualize the clients messages. If the message is too long and the generated command is longer than 1024 chars the server shows the dialog box of the exception handler with a warning about a possible buffer-overflow and naturally the match terminates. In reality the bug doesn't seem to be a real buffer-overflow but I have not deeply debugged the problem. This is an in-game bug so the attacker must have access to the server, if it's protected by password he must know the keyword and then his cd-key can be banned since CoD servers use the online authorization. ####################################################################### =========== 3) The Code =========== - download the following file:     http://aluigi.altervista.org/poc/codmsgboom.cfg - place it in the _base_ folder of the game: main or uo - start a client and a server - join the server - go into the client console (~ key) - type: /exec codmsgboom - the server will crash showing an error ####################################################################### ====== 4) Fix ====== No fix. Developers have not been contacted since already exists another unpatched bug from over one month (infostring overflow) and is more easy to exploit than this Windows-only problem where attackers can be banned and tracked. #######################################################################