Researcher Demonstrates Remote Code Execution in Neverwinter Nights Multiplayer

Summary

Thomas Dubier demonstrates remote code execution in Neverwinter Nights via malformed multiplayer messages: a memory leak defeats ASLR, enabling an out-of-bounds write to overwrite a return address. He warns re-released games may retain old bugs and lack mitigations.

Key points

• Dubier examines old and re-released games, noting that multiplayer networking can expose game clients to attack.
• In Neverwinter Nights, a server message with an unchecked index can trigger an out-of-bounds write that may overwrite a return address.
• A separate integer-underflow issue in message handling can expose client memory, providing a route to disclose the program's base address and bypass ASLR.
• A malicious server can use the portal transition to send the client to a second server and receive character-file data containing memory.
• Dubier combines the memory disclosure with the write primitive to demonstrate remote code execution against a client.
• He notes that re-released games can retain older vulnerabilities and may lack mitigations; a game loader can also disable DEP.