Luigi Auriemma has reported a vulnerability in Need for Speed Hot Pursuit 2, which potentially can be exploited by malicious people to compromise a user's system.

The client will reportedly send certain information requests to all servers in the master server's list when the user enters the Multiplayer screen of the game. However, there exists a boundary error in the handling of the servers' replies, which can be exploited to cause a buffer overflow by returning an overly long value to a client.

Successful exploitation may allow a malicious server to execute arbitrary code on a client system.

The vulnerability has been reported in build 242 and prior.

Solution
Play only multiplayer games on a trusted network and filter outbound traffic in a firewall.

Provided and/or discovered by
Luigi Auriemma

Original Advisory
http://aluigi.altervista.org/adv/nfshp2cbof-adv.txt

Deep Links
Links available to Secunia VIM customers