NoSuchCon #1 (2013) games proof-of-concepts

[aluigi]

I was checking my hard-disk and found the proof-of-concept code of some vulnerabilities made public via ReVuln in a paper made for the NoSuchCon #1 conference in 2013: Game Engines: A 0-Day's Tale

Even if over one year passed from the releasing of that paper, probably most (if not even all) these security issues are still unpatched.

The proof-of-concept code is available on http://poc.aluigi.org:

• Quake 4 getInfo stack-based overflow
• Homefront multiple vulnerabilities
• Sanctum and The Haunted: Hells Reach OutOfMemory/memset (it was already public in unrealfp)
• CryEngine 3 multiple vulnerabilities 0.1 (tested May 2013)
• Brink <= 1.0.23692.48133 multiple vulnerabilities 0.1
• Breach <= 1.1.0.-1 multiple vulnerabilities 0.1

[aluigi]

An html version of the paper is available here:
https://revuln.blogspot.com/2018/12/gam ... -2013.html