F.E.A.R. (First Encounter Assault and Recon, http://www.whatisfear.com)
is the recent FPS game developed by Monolith.
I knew it was vulnerable from many months but I was really curious to
see if the developers were so brave to leave this old "silent socket
termination" bug unpatched not only in the retail game released in
October but also in the 1.01 patch released just 4 days ago.
The original advisory and proof-of-concept I released in the far December
2004 are available here:
F.E.A.R. (First Encounter Assault and Recon, http://www.whatisfear.com)
is the recent FPS game developed by Monolith.
I knew it was vulnerable from many months but I was really curious to
see if the developers were so brave to leave this old "silent socket
termination" bug unpatched not only in the retail game released in
October but also in the 1.01 patch released just 4 days ago.
The original advisory and proof-of-concept I released in the far December
2004 are available here:
http://aluigi.altervista.org/adv/lithsock-adv.txt
http://aluigi.altervista.org/poc/lithsock.zip
---
Luigi Auriemma
http://aluigi.altervista.org
[ reply ]