Unreal Tournament 3 2.1 – ‘STEAMBLOB’ Remote Denial of Service

• Exploit Database
• 108 阅读

• 作者： Luigi Auriemma
  日期： 2010-07-20
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/14414/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83

  #Original Advisory: http://aluigi.org/adv/ut3steamer-adv.txt # #######################################################################   Luigi Auriemma   Application:Unreal Tournament III http://www.unrealtournament3.com Versions: <= 2.1 (aka 3809) Platforms:Windows (tested) and Linux Bug:unitialized pointer Exploitation: remote, versus server Date: 17 Jul 2010 Author: Luigi Auriemma e-mail: aluigi@autistici.org web:aluigi.org     #######################################################################     1) Introduction 2) Bug 3) The Code 4) Fix     #######################################################################   =============== 1) Introduction ===============     Unreal Tournament III is currently the latest game (2007) of the Unreal series created by Epic Games (http://www.epicgames.com).     #######################################################################   ====== 2) Bug ======     The game implements a particular command called STEAMBLOB which is handled in any case even if Steam is not running.   This command accepts three arguments that are C, N and B and just this last one (doesn&apos;t matter what value it has) is the cause of a problem during the handling of some pointers that are left unitialized. The effect is the crash of the whole server due to the access to invalid memory or a NULL pointer.   It&apos;s enough only one UDP packet to exploit the vulnerability so there are no limitations.     #######################################################################   =========== 3) The Code ===========     http://aluigi.org/fakep/unrealfp.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14414.zip (unrealfp.zip)   unrealfp -x 2 -c "STEAMBLOB B=" SERVER PORT     #######################################################################   ====== 4) Fix ======     No fix.     #######################################################################