CVE-2004-1525

Vulnerability

A denial-of-service vulnerability exists in Hired Team: Trial versions 2.0 and earlier, including 2.200. The bug is triggered when a remote attacker sends a specially crafted status command, causing an application crash [1]. The vulnerability is located in the game's network command handling, which does not properly validate the format of incoming status requests.

Exploitation

An unauthenticated attacker on the network can send a malicious status command to a running game server. No special privileges or user interaction are required [1]. The attack is performed remotely against the server, leveraging the game's network protocol.

Impact

Successful exploitation results in a denial of service, causing the Hired Team: Trial application to crash. The CIA impact is limited to availability; no data compromise or code execution is indicated [1].

Mitigation

At the time of disclosure, no official patch from the vendor was available. The author notes that Hired Team is an older game and may no longer be supported [1]. Users are advised to restrict network access to the game server or discontinue use of vulnerable versions. No CISA KEV listing was identified.