[40832] in bugtraq
F.E.A.R. 1.01 likes lithsock
daemon@ATHENA.MIT.EDU (Luigi Auriemma)
Fri Oct 21 13:13:15 2005
Date: Fri, 21 Oct 2005 18:21:36 +0200
From: Luigi Auriemma <aluigi@autistici.org>
To: bugtraq@securityfocus.com, bugs@securitytracker.com, news@securiteam.com,
full-disclosure@lists.grok.org.uk, vuln@secunia.com
Message-Id: <20051021182136.13693b43.aluigi@autistici.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
F.E.A.R. (First Encounter Assault and Recon, http://www.whatisfear.com)
is the recent FPS game developed by Monolith.
I knew it was vulnerable from many months but I was really curious to
see if the developers were so brave to leave this old "silent socket
termination" bug unpatched not only in the retail game released in
October but also in the 1.01 patch released just 4 days ago.
The original advisory and proof-of-concept I released in the far December
2004 are available here:
http://aluigi.altervista.org/adv/lithsock-adv.txt
http://aluigi.altervista.org/poc/lithsock.zip
---
Luigi Auriemma
http://aluigi.altervista.org
