Blizzard Activision World of Warcraft Damage Smite Spell privileges management

Summaryinfo

A vulnerability marked as problematic has been reported in Blizzard Activision World of Warcraft. This affects an unknown function of the component Damage Handler. This manipulation as part of Smite Spell causes privileges management. Furthermore, there is an exploit available. This vulnerability is considered historic because of its background and reception. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability has been found in Blizzard Activision World of Warcraft (the affected version is unknown) and classified as problematic. Affected by this vulnerability is an unknown code of the component Damage Handler. The manipulation as part of a Smite Spell leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was shared 10/07/2012 by Jadd, Master674 and Cencil as not defined exploit (Server) via BBC. It is possible to read the advisory at bbc.co.uk. The vendor was not involved in the public release. The attack can be launched remotely. A single authentication is needed for exploitation. Technical details are unknown but a public exploit is available. The pricing for an exploit might be around USD at the moment (estimation calculated on 05/01/2018). The attack technique deployed by this issue is T1068 according to MITRE ATT&CK. Due to its background and reception, this vulnerability has a historic impact.

A public exploit has been developed by Jadd/Master674 / Cencil and been published immediately after the advisory. It is possible to download the exploit at youtube.com. It is declared as highly functional. We expect the 0-day to have been worth approximately $25k-$100k. Olivia Grace, contributing editor of website WoW Insider, said: "It was a significant hack."

Applying a patch is able to eliminate this problem. The bugfix is ready for download at us.battle.net. A possible mitigation has been published 15 hours after the disclosure of the vulnerability. The statement in the official forum was: "This exploit has already been hotfixed, so it should not be repeatable."

Additional details are provided at wow.joystiq.com. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Blizzard Activision

Name

• World of Warcraft

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

Screenshot

Video

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion