Luigi Auriemma has reported a vulnerability in Need for Speed Hot Pursuit 2, which potentially can be exploited by malicious people to compromise a user's system.
The client will reportedly send certain information requests to all servers in the master server's list when the user enters the Multiplayer screen of the game. However, there exists a boundary error in the handling of the servers' replies, which can be exploited to cause a buffer overflow by returning an overly long value to a client.
Successful exploitation may allow a malicious server to execute arbitrary code on a client system.
The vulnerability has been reported in build 242 and prior.
Solution: Play only multiplayer games on a trusted network and filter outbound traffic in a firewall.
Provided and/or discovered by: Luigi Auriemma
Original Advisory: http://aluigi.altervista.org/adv/nfshp2cbof-adv.txt
Do you have additional information related to this advisory?
Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this
information to firstname.lastname@example.org
Subject: Need for Speed Client Buffer Overflow Vulnerability
No posts yet
You must be logged in to post a comment.
Secunia Customer Login
Not a customer already?
Learn more about how our market leading Vulnerability Management solutions can help you manage risk and ensure compliance.