The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Alien Arena's Multiple Vulnerabilities
------------------------------------------------------------------------
SUMMARY
<http://red.planetarena.org> Alien Arena 2006 GE is the latest release of
the CodeRED series, an open source game developed on an enhanced version
(CRX engine) of the GPLed Quake II engine. The game supports both LAN and
Internet multiplayer.
Multiple vulnerabilities discovered in Alien Arena. All the
vulnerabilities need to be exploited in-game so the attacker should be
have the password if it's password protected, as well as not banned.
DETAILS
Vulnerable Systems:
* Alien Arena 2006 Gold Edition versions 5.00 and previous
Server format string (safe_cprintf):
The safe_cprintf() function used by the server for sending messages to the
clients is affected by a format string vulnerability which could allow the
execution of malicious code. After having built the output string the
function passes it as format argument (yes it's just like a double
sprintf) to gi.cprintf() -> "void PF_cprintf (edict_t *ent, int level,
char *fmt, ...)".
From games/acesrc/acebot_cmds.c:
void safe_cprintf (edict_t *ent, int printlevel, char *fmt, ...)
{
char bigbuffer[0x10000];
va_list argptr;
int len;
if (ent && (!ent->inuse || ent->is_bot))
return;
va_start (argptr,fmt);
len = vsprintf (bigbuffer,fmt,argptr);
va_end (argptr);
gi.cprintf(ent, printlevel, bigbuffer);
}
Server buffer-overflow (Cmd_Say_f):
The function Cmd_Say_f is used by the server for handling the text
messages received from the clients. Cmd_Say_f uses a buffer of 2048 bytes
in which puts the nickname of the player who has sent the message using
the secure (enough secure) Com_sprintf() function followed by strcat() for
appending the received message. These instructions allow an attacker to
exploit the resulted buffer-overflow for executing malicious code.
From source/game/g_cmds.c:
void Cmd_Say_f (edict_t *ent, qboolean team, qboolean arg0)
{
int i, j;
edict_t *other;
char *p;
char text[2048];
gclient_t *cl;
if (gi.argc () < 2 && !arg0)
return;
if ((!((int)(dmflags->value) & (DF_MODELTEAMS | DF_SKINTEAMS))) ||
(!ctf->value))
team = false;
if (team)
Com_sprintf (text, sizeof(text), "(%s): ", ent->client->pers.netname);
else
Com_sprintf (text, sizeof(text), "%s: ", ent->client->pers.netname);
if (arg0)
{
strcat (text, gi.argv(0));
strcat (text, " ");
strcat (text, gi.args());
}
else
{
p = gi.args();
if (*p == '"')
{
p++;
p[strlen(p)-1] = 0;
}
strcat(text, p);
}
...
Crash (Com_sprintf):
The Com_sprintf() function is a custom snprintf() replacement widely used
in the code. The only problem of this function (usually bigbuffer is big
enough so it doesn't represent a risk) is caused by the final strncpy()
call which is not followed by an instruction for delimiting dest with a
NULL byte. Often, depending by the system/compiler, this lack leads to a
crash. In my tests I were able to crash the precompiled Windows clients
without problems through a skin of about 110 chars (MAX_OSPATH is 128). In
fact one of the best ways for exploiting this bug is just using a player
with a long skin, weapon or model name so any client which is inside or
will join the server while the attacker is playing will be crashed
immediately. In this case we can watch the exploitation in the function
CL_LoadClientinfo() located in client/cl_parse.c.
From source/game/q_shared.c:
void Com_sprintf (char *dest, int size, char *fmt, ...)
{
int len;
va_list argptr;
char bigbuffer[0x10000];
va_start (argptr,fmt);
len = vsprintf (bigbuffer,fmt,argptr);
va_end (argptr);
if (len >= size)
Com_Printf ("Com_sprintf: overflow of %i in %i\n", len, size);
strncpy (dest, bigbuffer, size-1);
}
Proof of Concept:
<http://aluigi.altervista.org/poc/aa2k6x.zip>
http://aluigi.altervista.org/poc/aa2k6x.zip
Fix:
No fix so far. The developers will release a patch in the next months.
ADDITIONAL INFORMATION
The information has been provided by <mailto:aluigi@autistici.org> Luigi
Auriemma.
The original article can be found at:
<http://aluigi.altervista.org/adv/aa2k6x-adv.txt>
http://aluigi.altervista.org/adv/aa2k6x-adv.txt
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
