what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

simbin.txt

simbin.txt
Posted Feb 24, 2007
Authored by Luigi Auriemma | Site aluigi.org

Games developed by SimBin suffer from a denial of service flaw where a UDP packet of zero bytes sent to the server disconnects all clients.

tags | advisory, denial of service, udp
SHA-256 | fa5e287f5b93583af9eab52af614b8dc703f1025f7cf7aec03ff410c09fbf9f7

simbin.txt

Change Mirror Download

#######################################################################

Luigi Auriemma

Applications: games developed by SimBin Development Team
http://www.simbin.se
Versions: GTR - FIA GT Racing Game <= 1.5.0.0
http://www.gtr-game.com
GT Legends <= 1.1.0.0
http://www.gt-legends.com
GTR 2 <= 1.1
http://www.gtr-game.com
RACE - The WTCC Game <= 1.0 (0.6.3.0?)
http://www.race-game.org
Platforms: Windows
Bug: clients disconnection
Exploitation: remote, versus clients
Date: 21 Feb 2007
Author: Luigi Auriemma
e-mail: aluigi@autistici.org
web: aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Simbin is a well known software house specialized in the developing of
racing games deeply devopted to extreme simulation.
All their games are very recent, GTR was released in November 2004
while Race WTCC exactly two years later.


#######################################################################

======
2) Bug
======


The problem is very simple, an UDP packet of zero bytes (empty) sent to
the main port of the server (usually 48942 for Race WTCC and 34297 for
the other games) forces the disconnection of all the clients connected
to it.
The attacker needs only to send one packet (spoofing possible) and the
clients in the game will be immediately kicked with the message "Lost
connection with the Host".
Then they can re-join again... but can be re-kicked in the same way
too.


#######################################################################

===========
3) The Code
===========


- get udpsz from here:

http://aluigi.org/testz/udpsz.zip

- launch it versus the server:

udpsz 127.0.0.1 34297 0 for GTR, GTR2 and GT Legends
udpsz 127.0.0.1 48942 0 for Race WTCC

- check what happened to the clients connected to it


#######################################################################

======
4) Fix
======


No fix.
No reply received from the developers.


#######################################################################


---
Luigi Auriemma
http://aluigi.org
http://mirror.aluigi.org
Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    6 Files
  • 17
    Jul 17th
    34 Files
  • 18
    Jul 18th
    6 Files
  • 19
    Jul 19th
    34 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    19 Files
  • 23
    Jul 23rd
    17 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close