Luigi Auriemma has reported two vulnerabilities in F.E.A.R. (First Encounter Assault and Recon), which can be exploited by malicious people to cause a DoS (Denial of Service), and potentially to compromise a vulnerable system.

1) Some format string errors in the processing of messages and nicknames can potentially be exploited to compromise a vulnerable system.

For more information:
SA13116

Successful exploitation may allow execution of arbitrary code, but requires that the "Punkbuster" feature is enabled on the affected server for versions above 1.02.

The vulnerability is reported in version 1.08 and prior. Other versions may also be affected.

2) An error in the communication handling can be exploited to cause a DoS.

For more information:
SA13446

The vulnerability is reported in the retail version and in version 1.01 patch. Version 1.02 is reportedly still vulnerable when handling UDP packets larger than 8192 bytes.

Solution
Host games on a trusted network only.

Provided and/or discovered by
Luigi Auriemma

Changelog
Further details available in Customer Area

Original Advisory
1) http://aluigi.altervista.org/adv/fearfspb-adv.txt
2) http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/038095.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area