what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

raceDriver120.txt

raceDriver120.txt
Posted Jul 19, 2005
Authored by Luigi Auriemma | Site aluigi.altervista.org

Race Driver versions 1.20 and below suffer from multiple misuses of sprintf().

tags | advisory
SHA-256 | 02f796a6660bf052f315c2aec0a95aaaaad22a70850dd0539131767f449abbe5

raceDriver120.txt

Change Mirror Download

#######################################################################

Luigi Auriemma

Application: Race Driver
http://www.codemasters.com/tocaracedriver/
Versions: <= 1.20
Platforms: Windows
Bugs: A] broadcast format string
B] broadcast buffer-overflow
Exploitation: remote, versus any user in the public chat or through
malformed server replies (broadcast)
Date: 18 Jul 2005
Author: Luigi Auriemma
e-mail: aluigi@autistici.org
web: http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Race Driver is a funny but poorly supported racing game developed and
published by Codemasters (http://www.codemasters.com).
It has been released in March 2003.


#######################################################################

======
2) Bug
======


Race Driver incorrectly uses sprintf() for building different types of
text strings usually used for the visualization of the data.
The places where this bad sprintf() can be exploited are at least 2:
the public chat hosted on the encrypted IRC server peerchat.gamespy.com
and the in-game server browser.

The public chat is a place used by Race Driver while the users wait for
a free server to join. The users automatically join it when they choose
to play on Internet from the Network menu... it is an useless but
forced stage.
Other than the messages in the channel the game supports also the
private messages (whispers) so an attacker can decide to attack a
specific user or just all the users in the room.

The in-game server browser instead is where are showed and ordered the
online servers through the informations received in their replies.

The sprintf() function is affected by two bugs: a format string and a
buffer-overflow caused by text strings of 264 chars.


#######################################################################

===========
3) The Code
===========


For testing the bugs through the chat is enough to use the same game or
an IRC client with a Peerchat proxy.
The example chat messages (or also nicknames) for exploiting the bugs
are the following:
%n%n%n
and

aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaRETA

The raw names of the channels used by Race Driver are: #GPG!511 (the
main), #GPG!510, #GPG!508, #GPG!507, #GPG!506, #GPG!509, #GPG!513,
#GPG!512, #GPG!485, #GPG!486 and (for some milliseconds)
#GSP!racedriver

For testing the bugs through a malicious server you need only to host a
game with the name %n%n%n.


#######################################################################

======
4) Fix
======


This game is no longer supported.


#######################################################################


---
Luigi Auriemma
http://aluigi.altervista.org
Login or Register to add favorites

File Archive:

February 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    16 Files
  • 2
    Feb 2nd
    19 Files
  • 3
    Feb 3rd
    0 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    24 Files
  • 6
    Feb 6th
    2 Files
  • 7
    Feb 7th
    10 Files
  • 8
    Feb 8th
    25 Files
  • 9
    Feb 9th
    37 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    17 Files
  • 13
    Feb 13th
    20 Files
  • 14
    Feb 14th
    25 Files
  • 15
    Feb 15th
    15 Files
  • 16
    Feb 16th
    6 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    35 Files
  • 20
    Feb 20th
    25 Files
  • 21
    Feb 21st
    18 Files
  • 22
    Feb 22nd
    15 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files
  • 29
    Feb 29th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close