#Original Advisory: http://aluigi.org/adv/ut3steamer-adv.txt
#
#######################################################################
Luigi Auriemma
Application: Unreal Tournament III
http://www.unrealtournament3.com
Versions: <= 2.1 (aka 3809)
Platforms: Windows (tested) and Linux
Bug: unitialized pointer
Exploitation: remote, versus server
Date: 17 Jul 2010
Author: Luigi Auriemma
e-mail: aluigi@autistici.org
web: aluigi.org
#######################################################################
1) Introduction
2) Bug
3) The Code
4) Fix
#######################################################################
===============
1) Introduction
===============
Unreal Tournament III is currently the latest game (2007) of the Unreal
series created by Epic Games (http://www.epicgames.com).
#######################################################################
======
2) Bug
======
The game implements a particular command called STEAMBLOB which is
handled in any case even if Steam is not running.
This command accepts three arguments that are C, N and B and just this
last one (doesn't matter what value it has) is the cause of a problem
during the handling of some pointers that are left unitialized.
The effect is the crash of the whole server due to the access to
invalid memory or a NULL pointer.
It's enough only one UDP packet to exploit the vulnerability so there
are no limitations.
#######################################################################
===========
3) The Code
===========
http://aluigi.org/fakep/unrealfp.zip
http://www.exploit-db.com/sploits/unrealfp.zip
unrealfp -x 2 -c "STEAMBLOB B=" SERVER PORT
#######################################################################
======
4) Fix
======
No fix.
#######################################################################
