Exploit aGSM 2.35 Half-Life Server - Info Response Buffer Overflow (PoC)

[Exploiter]

EDB-ID

24388

Проверка EDB

1. Пройдено

Автор

DIMETRIUS

Тип уязвимости

DOS

Платформа

MULTIPLE

CVE

cve-2004-2277

Дата публикации

2004-08-20

aGSM 2.35 Half-Life Server - Info Response Buffer Overflow (PoC)

source: https://www.securityfocus.com/bid/10989/info

aGSM is reported prone to a remote buffer overflow vulnerability. The issue presents itself in the aGSM server information parsing routines for Half-Life game servers. Due to a lack of sufficient bounds checking performed on the hostname parameter in a server reply to an info request, a malicious server may execute arbitrary code on an affected client.

It should be noted that although aGSM version 2.35c is reported prone to this vulnerability, other versions might also be affected.

For the following query:
\xFF\xFF\xFF\xFFinfo\x00
The following response is sent:
\xff\xff\xff\xffA\x00AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA