F.E.A.R. (First Encounter Assault and Recon, http://www.whatisfear.com) is the recent FPS game developed by Monolith. I knew it was vulnerable from many months but I was really curious to see if the developers were so brave to leave this old "silent socket termination" bug unpatched not only in the retail game released in October but also in the 1.01 patch released just 4 days ago. The original advisory and proof-of-concept I released in the far December 2004 are available here: http://aluigi.altervista.org/adv/lithsock-adv.txt http://aluigi.altervista.org/poc/lithsock.zip --- Luigi Auriemma http://aluigi.altervista.org
