#######################################################################

                             Luigi Auriemma

Application:  Team Factor (aka US Special Forces)
              http://www.teamfactor.co.uk/
              http://ms7fx.iccc.cz/teamfactor/
Versions:     <= 1.25
              (note: 1.25 and 1.25m uses the same vulnerable exe)
Platforms:    Windows and Linux
Bug:          reading of unallocated memory (crash)
Risk:         high
Exploitation: remote, versus server
Date:         20 Feb 2004
Author:       Luigi Auriemma
              e-mail: aluigi@altervista.org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


>From developers'site:

"Team Factor is a stand-alone multi-player action game designed with
team play in mind. The games mission, environment and objective is
inspired by the 'shadow' military operations - whether real or fiction
style."


#######################################################################

======
2) Bug
======


At offset 12 of each packet there is a 16bit value used to specify the
size of the data block that follows it.
This value is read as a signed short so if we use a negative value the
game will read unallocated memory (memcpy() instruction) and will
crash immediately.
The following are the instructions that cause the crash in the Win32
1.25 version:

:00530D23 0FBF6C240E              movsx ebp, word ptr [esp+0E]
...
:00530D6B F3A5                    repz movsd

:00530D23   16bit value read as signed short, movsx
:00530D6B   copying of the data block into the new buffer, memcpy()


#######################################################################

===========
3) The Code
===========


http://aluigi.altervista.org/poc/tfboom.zip


#######################################################################

======
4) Fix
======


No fix.
Developers have not answered to my mails.

Fortunally fixing the problem is very simple in fact we must only
manage the 16bit value as an UNsigned short instead of a signed short:

from :00530D23 0FBF6C240E              movsx ebp, word ptr [esp+0E]
to   :00530D23 0FB76C240E              movzx ebp, word ptr [esp+0E]

My unofficial patch for the Win32 version 1.25/m is available here:

  http://aluigi.altervista.org/patches/tfboomw125.zip


#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org