exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

aa2k6x.txt

aa2k6x.txt
Posted Mar 9, 2006
Authored by Luigi Auriemma | Site aluigi.altervista.org

Alien Arena 2006 Gold Edition versions 5.00 and below suffer from format string and buffer overflow vulnerabilities.

tags | advisory, overflow, vulnerability
SHA-256 | 758b2865a8389885d4f51a1d927a643500f2bd9557c72ef68f88f5c01b9939b9

aa2k6x.txt

Change Mirror Download

#######################################################################

Luigi Auriemma

Application: Alien Arena 2006 Gold Edition
http://red.planetarena.org
Versions: <= 5.00
Platforms: Windows and Linux
Bugs: A] safe_cprintf server format string
B] Cmd_Say_f server buffer-overflow
C] Com_sprintf crash
Exploitation: A] remote, versus server (in-game)
B] remote, versus server (in-game)
C] remote, versus clients and server (in-game)
Date: 07 Mar 2006
Author: Luigi Auriemma
e-mail: aluigi@autistici.org
web: http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Alien Arena 2006 GE is the latest release of the CodeRED series, an
open source game developed on an enhanced version (CRX engine) of the
GPLed Quake II engine.
The game supports both LAN and Internet multiplayer.


#######################################################################

=======
2) Bugs
=======


All the bugs need to be exploited in-game so the attacker's IP must be
not banned and he must know the right keyword if the server is
protected by password.
I have found no ways to exploit them "externally".


------------------------------------
A] safe_cprintf server format string
------------------------------------

The safe_cprintf() function used by the server for sending messages to
the clients is affected by a format string vulnerability which could
allow the execution of malicious code.
After having built the output string the function passes it as format
argument (yes it's just like a double sprintf) to gi.cprintf() ->
"void PF_cprintf (edict_t *ent, int level, char *fmt, ...)".

>From games/acesrc/acebot_cmds.c:
void safe_cprintf (edict_t *ent, int printlevel, char *fmt, ...)
{
char bigbuffer[0x10000];
va_list argptr;
int len;

if (ent && (!ent->inuse || ent->is_bot))
return;

va_start (argptr,fmt);
len = vsprintf (bigbuffer,fmt,argptr);
va_end (argptr);

gi.cprintf(ent, printlevel, bigbuffer);

}


-----------------------------------
B] Cmd_Say_f server buffer-overflow
-----------------------------------

The function Cmd_Say_f is used by the server for handling the text
messages received from the clients.
Cmd_Say_f uses a buffer of 2048 bytes in which puts the nickname of the
player who has sent the message using the secure (enough secure)
Com_sprintf() function followed by strcat() for appending the received
message.
These instructions allow an attacker to exploit the resulted
buffer-overflow for executing malicious code.

>From source/game/g_cmds.c:
void Cmd_Say_f (edict_t *ent, qboolean team, qboolean arg0)
{
int i, j;
edict_t *other;
char *p;
char text[2048];
gclient_t *cl;

if (gi.argc () < 2 && !arg0)
return;

if ((!((int)(dmflags->value) & (DF_MODELTEAMS | DF_SKINTEAMS)))
|| (!ctf->value)) team = false;

if (team)
Com_sprintf (text, sizeof(text), "(%s): ",
ent->client->pers.netname); else
Com_sprintf (text, sizeof(text), "%s: ",
ent->client->pers.netname);

if (arg0)
{
strcat (text, gi.argv(0));
strcat (text, " ");
strcat (text, gi.args());
}
else
{
p = gi.args();

if (*p == '"')
{
p++;
p[strlen(p)-1] = 0;
}
strcat(text, p);
}
...


--------------------
C] Com_sprintf crash
--------------------

The Com_sprintf() function is a custom snprintf() replacement widely
used in the code.
The only problem of this function (usually bigbuffer is enough big so
doesn't represent a risk) is caused by the final strncpy() call which
is not followed by an instruction for delimiting dest with a NULL byte.
Often, depending by the system/compiler, this lack leads to a crash.
In my tests I were able to crash the precompiled Windows clients
without problems through a skin of about 110 chars (MAX_OSPATH is 128).
In fact one of the best ways for exploiting this bug is just using a
player with a long skin, weapon or model name so any client which is
inside or will join the server while the attacker is playing will be
crashed immediately.
In this case we can watch the exploitation in the function
CL_LoadClientinfo() located in client/cl_parse.c.

>From source/game/q_shared.c:
void Com_sprintf (char *dest, int size, char *fmt, ...)
{
int len;
va_list argptr;
char bigbuffer[0x10000];

va_start (argptr,fmt);
len = vsprintf (bigbuffer,fmt,argptr);
va_end (argptr);
if (len >= size)
Com_Printf ("Com_sprintf: overflow of %i in %i\n", len,
size); strncpy (dest, bigbuffer, size-1);
}


#######################################################################

===========
3) The Code
===========


http://aluigi.altervista.org/poc/aa2k6x.zip


#######################################################################

======
4) Fix
======


No fix.
The developers will release a patch the next months.


#######################################################################


---
Luigi Auriemma
http://aluigi.altervista.org
Login or Register to add favorites

File Archive:

September 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    261 Files
  • 2
    Sep 2nd
    17 Files
  • 3
    Sep 3rd
    38 Files
  • 4
    Sep 4th
    52 Files
  • 5
    Sep 5th
    23 Files
  • 6
    Sep 6th
    27 Files
  • 7
    Sep 7th
    0 Files
  • 8
    Sep 8th
    1 Files
  • 9
    Sep 9th
    16 Files
  • 10
    Sep 10th
    38 Files
  • 11
    Sep 11th
    21 Files
  • 12
    Sep 12th
    40 Files
  • 13
    Sep 13th
    18 Files
  • 14
    Sep 14th
    0 Files
  • 15
    Sep 15th
    0 Files
  • 16
    Sep 16th
    21 Files
  • 17
    Sep 17th
    51 Files
  • 18
    Sep 18th
    23 Files
  • 19
    Sep 19th
    48 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close