Title:Format string vulnerability in 5th street (Hot Step, High Street 5)
Reporter:Blue Moon Consulting, superkhung
Products:5th street and derived clients
Fixed in:--


5th street is a massively multiplayer online dance game produced by Snail Game and distributed in countries such as Malaysia, Singapore and Vietnam under different names High Street 5, Hot Step.

5th street contains a format string vulnerability in its dx8render.dll module. Before a chat message is rendered in a balloon, this message is used as a format string in a call to vsnwprintf function.

This vulnerability allows an attacker to remotely and instantly crash other players' clients. If carefully exploited, this will also lead to arbitrary code execution on the target machine.


There is no workaround.


Customers are advised to contact your local game distributor in order to obtain a proper fix.


Blue Moon Consulting adapts RFPolicy v2.0 in notifying vendors.

Initial vendor contact:

June 15, 2008: Initial contact sent to

June 17, 2008: Another request for communication sent to and local game distributors

Vendor response:

June 17, 2008: Further communication requested to be sent to James Gaoyu of Snail Game

Further communication:

June 17, 2008: Technical details and request for estimated time of a patch sent to James Gaoyu

June 22, 2008: Request for estimated time of a patch sent to James Gaoyu

June 23, 2008: Alert sent to local game distributors

Public disclosure:

June 25, 2008

Exploit code:

Send a chat message containing %5000000.x


The information provided in this advisory is provided "as is" without warranty of any kind. Blue Moon Consulting Co., Ltd disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. Your use of the information on the advisory or materials linked from the advisory is at your own risk. Blue Moon Consulting Co., Ltd reserves the right to change or update this notice at any time.