The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
OpenBOR Multiple Format String
------------------------------------------------------------------------
SUMMARY
Beats of Rage (BOR) is a very nice open source beat'em up engine developed
by <http://www.senileteam.com> Senile Team and inspired by games like
"Streets of Rage" and "the King of Fighters". It works on many platforms
and supports mods:
<http://borrevolution.vg-network.com> http://borrevolution.vg-network.com
<http://www.borhosting.com> http://www.borhosting.com
Some format string vulnerabilities exist in BOR which can be exploited
through malicious mod files.
DETAILS
The following are the pieces of code containing the bugs, anyway the most
used functions are just shutdown (used to kill the game at its end or when
an error is occurred) and update (for showing the text on the screen
through the font_printf function):
void shutdown(char *msg, ...){
static char buf[2048];
va_list arglist;
va_start(arglist, msg);
vsprintf(buf, msg, arglist);
va_end(arglist);
...
printf("Done.\n\n\n\n");
printf(buf);
exit(0);
}
From predrawstatus():
font_printf(21+xo, savedata.windowpos+19, 0,
player[i].opponent->name);
...
else if(player[i].joining && player[i].model){
font_printf(21+xo, savedata.windowpos+2, 0,
player[i].model->name);
...
From update():
font_printf(0,230, 0, debug_msg);
From choose_difficulty:
if(savedata.times_completed >= ifcomplete[i])
font_printf(120,160+i*10, (selector==i), set_names[i]);
Take an existing mod and:
- add the following line in data/scenes/intro.txt:
music %08x.%08x.%08x.%08x 0
- add the following line in data/easy/1aeasy.txt:
background %08x.%08x.%08x.%08x
The first operation exploits the format string in the update function when
the game starts and the intro is automatically launched. The second one
instead exploits the bug located in the shutdown function when the Easy
level is selected and the character is chosen.
For extracting and rebuilding the PAK files is possible to use the
following tool:
<http://aluigi.org/papers/borpak.zip>
http://aluigi.org/papers/borpak.zip
Fix:
No fix.
BOR is no longer supported while OpenBOR yes but I have received no
replies from its developers.
ADDITIONAL INFORMATION
The information has been provided by <mailto:aluigi@autistici.org> Luigi
Auriemma.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
