#######################################################################

                             Luigi Auriemma

Applications: Unreal Tournament 2004
               http://www.unrealtournament2003.com/ut2004/index.html
              Red Orchestra
              Shadow Ops: Red Mercury
              America's Army (released a specific advisory for it)
              possibly others
Versions:     <= v3369
Platforms:    Windows and Linux
Bug:          NULL pointer
Exploitation: remote, versus server
Date:         30 Jul 2008
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Unreal Tournament 2004 is a well known FPS game developed by Epic Games
(http://www.epicgames.com) and released at the beginning of the 2004.


#######################################################################

======
2) Bug
======


UPDATE 02 Aug 2008
UT2004 and some other games (included America's Army for which has been
released a specific advisory) are affected by a NULL pointer exception
caused by a particular type of packet (type 4).
In some cases, like in America's Army or in UT2004 when running in
listening mode, the effect is not the crash but the immediate
termination of the server due to the following error:

  "Assertion failed: VoiceIndex<VOICE_MAX_CHATTERS"

Only one packet is needed to exploit the bug, so is possible to spoof
it too.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/ut2004null.zip


#######################################################################

======
4) Fix
======


No fix

UPDATE 15 Sep 2008
released an unofficial work-around (marked as experimental) for the
Windows version of the affected games:

  http://aluigi.org/patches/voiceindexfix.lpatch


#######################################################################