vendor:
Ghost Recon Advanced Warfighter & Ghost Recon Advanced Warfighter 2
by:
Luigi Auriemma
5
CVSS
MEDIUM
Integer & Array Indexing Overflow
190 (Integer Overflow or Wraparound) & 125 (Out-of-bounds Read)
CWE
Product Name: Ghost Recon Advanced Warfighter & Ghost Recon Advanced Warfighter 2
Affected Version From: GRAW <= 1.35 & GRAW2 <= 1.05
Affected Version To: GRAW <= 1.35 & GRAW2 <= 1.05
Patch Exists: YES
Related CWE: N/A
CPE: a:grin:ghost_recon_advanced_warfighter:1.35 & cpe:/a:grin:ghost_recon_advanced_warfighter_2:1.05
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows
2010
Ghost Recon Advanced Warfighter & Ghost Recon Advanced Warfighter 2 Integer & Array Indexing Overflow
The games are affected by an integer overflow in a particular type of packet that makes the following operations: takes the number from a 16 bit field (offset 4), multiplicates it by 1300, takes the 32 bit number after it at offset 6, substracts the first number from the second one, checks if the result is bigger than the size of the packet (signed), performs a byte-per-byte copying on a heap buffer. In some types of packets an 8bit value is used for accessing an array used for internal operations (pointers and so on). So through the setting of particular values for that 8bit field is possible to crash the server during these internal operations.
Mitigation:
Upgrade to the latest version of the game.
