CyberSec.Space Logo
Back to CVE Browser

CVE-2018-20817

CRITICAL
9.8
CVSS Severity Score
EPSS Score0.0720%
EPSS Percentile44.06th
PublishedApr 19, 2019
Last ModifiedNov 21, 2024

Vulnerability Description

SV_SteamAuthClient in various Activision Infinity Ward Call of Duty games before 2015-08-11 is missing a size check when reading authBlob data into a buffer, which allows one to execute code on the remote target machine when sending a steam authentication request. This affects Call of Duty: Modern Warfare 2, Call of Duty: Modern Warfare 3, Call of Duty: Ghosts, Call of Duty: Advanced Warfare, Call of Duty: Black Ops 1, and Call of Duty: Black Ops 2.

Affected Platforms (CPE)

📦
Activision

Call Of Duty\

= _advanced_warfare
📦
Activision

Call Of Duty\

= _black_ops_1
📦
Activision

Call Of Duty\

= _blacks_ops_2
📦
Activision

Call Of Duty\

= _ghosts
📦
Activision

Call Of Duty\

= _modern_warfare_2
📦
Activision

Call Of Duty\

= _modern_warfare_3

References & Advisories

🔗 https://github.com/RektInator/cod-steamauth-rce
🔗 https://github.com/momo5502/cod-exploits/tree/master/steam-auth
🔗 https://github.com/RektInator/cod-steamauth-rce
🔗 https://github.com/momo5502/cod-exploits/tree/master/steam-auth

Related Vulnerabilities

CVE-2018-1071810.0

Stack-based buffer overflow in Activision Infinity Ward Call of Duty Modern Warfare 2 before 2018-04-26 allows remote attackers to...

CVE-2019-208939.8

An issue was discovered in Activision Infinity Ward Call of Duty Modern Warfare 2 through 2019-12-11. PartyHost_HandleJoinPartyReq...

CVE-2006-50587.5

Buffer overflow in (1) Call of Duty 1.5b and earlier, (2) Call of Duty United Offensive 1.51b and earlier, and (3) Call of Duty 2 ...

CVE-2007-07577.5

PHP remote file inclusion vulnerability in index.php in Miguel Nunes Call of Duty 2 (CoD2) DreamStats System 4.2 and earlier allow...