its cod2 1.0 ! and i tried all the reasons on same server and none crashed server.
but i didnt try this :
Code:
A] "Attempted to overrun string in call to va()" DoS
----------------------------------------------------
va() is a function of the Quake 3 engine used to quickly build strings
using snprintf and a static destination buffer.
If the generated string is longer than the available buffer the server
shows an "Attempted to overrun string in call to va()" error and
terminates.
From Call of Duty 2 (and consequently CoD4) the size of this buffer has
been reduced from the original 32000 bytes to only 1024 causing many
problems to the admins, for which reason I created an unofficial fix
for CoD2 in the far 2006 (http://aluigi.org/patches/cod2vawo.lpatch).
So in CoD4 an attacker which has joined the server can exploit this
vulnerability through the sending of a command longer than 1024 bytes
causing the immediate termination of the server.
UPDATE 07 Jul 2010:
It's NOT needed to join the server for exploiting this bug, indeed it's
enough to send a getchallenge packet with a long hash:
yyyygetchallenge 0 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa...1025...aaa
Only the LAN server aren't affected by this way because they don't
read that part of the packet.
any help ??!
