Medieval Total War <= 1.1 broadcast Connection expired

2003-10-08T00:00:00
ID SECURITYVULNS:DOC:5225
Type securityvulns
Reporter Securityvulns
Modified 2003-10-08T00:00:00

Description

                         Luigi Auriemma

Application: Medieval Total War http://www.totalwar.com Versions: <= 1.1 Platforms: Windows Bug: "Connection expired" message to server and connected clients caused by malformed nickname Risk: Low Author: Luigi Auriemma e-mail: aluigi@altervista.org web: http://aluigi.altervista.org

1) Introduction 2) Bug 3) The Code 4) Fix

=============== 1) Introduction ===============

Medieval Total War is a real-time strategy game available on PC and is developed by Creative Assembly.

====== 2) Bug ======

The MTW's players have access to the server only in a specific moment and not during the execution of the game. This moment is the Lobby screen before the starting of the match where all the players can join.

The bug is in the management of the nicknames sent by the clients, in fact a malformed nickname (for example of a length of 0 unicode chars) have a nice and interesting effect versus the server and all the clients connected to it.

This effect is a message that will appear just in front of all the players:

"Connection expired"

Then the server must restart the match and the players must rejoin again.

=========== 3) The Code ===========

Use the following proof-of-concept specifying 0 as first command-line argument:

http://aluigi.altervista.org/poc/mtwdos-server.zip

====== 4) Fix ======

No fix. I have contacted Creative Assembly a lot of months ago but they didn't have the resources to patch this bug.


Luigi Auriemma http://aluigi.altervista.org