CVE-2018-20817 Information

Description

SV_SteamAuthClient in various Activision Infinity Ward Call of Duty games before 2015-08-11 is missing a size check when reading authBlob data into a buffer which allows one to execute code on the remote target machine when sending a steam authentication request. This affects Call of Duty: Modern Warfare 2 Call of Duty: Modern Warfare 3 Call of Duty: Ghosts Call of Duty: Advanced Warfare Call of Duty: Black Ops 1 and Call of Duty: Black Ops 2.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Reference

https://github.com/momo5502/cod-exploits/tree/master/steam-auth https://github.com/RektInator/cod-steamauth-rce

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

9.8