The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
PunkBuster for Servers WebTool Buffer Overflow
------------------------------------------------------------------------
SUMMARY
" <http://www.punkbuster.com/> PunkBuster(tm) Anti-Cheat software
technology and services combat online cheating in some of the most popular
games being played over the Internet today. "
Improper length handling allow attackers to execute arbitrary code by
using PunkBuster WebTool.
DETAILS
Vulnerable Systems:
* PunkBuster for servers version 1.228 and prior
* America's Army version 1.228 and prior
* Battlefield 1942 version 1.158 and prior
* Battlefield 2 version 1.184 and prior
* Battlefield Vietnam version 1.150 and prior
* Call of Duty version 1.173 and prior
* Call of Duty 2 version 1.108 and prior
* DOOM 3 version 1.159 and prior
* Enemy Territory version 1.167 and prior
* Far Cry version 1.150 and prior
* F.E.A.R. version 1.093 and prior
* Joint Operations version 1.187 and prior
* Quake III Arena version 1.150 and prior
* Quake 4 version 1.181 and prior
* Rainbow Six 3: Raven Shield version 1.169 and prior
* Rainbow Six 4: Lockdown version 1.093 and prior
* Return to Castle Wolfenstein version 1.175 and prior
* Soldier of Fortune II version 1.183 and prior
Immune Systems:
* PunkBuster for servers version 1.229
PunkBuster contains a built-in HTTP server called WebTool for allowing the
admins to manage their game servers remotely through a normal web browser:
http://www.evenbalance.com/publications/admins/#webtool
This web server is not enabled by default but must be activated selecting
the TCP port on which running the service using the command:
pb_sv_httpport PORT
The authentication mechanism is handled through a parameter called webkey
followed by the password and sent by the client using the POST method or
directly in the URL.
A webkey longer than 1024 bytes exploits a buffer-overflow which happens
when the program uses the memcpy function for copying the attacker string
in a limited buffer used for the comparison with the valid service's
password.
The following is the code from the pbsv.dll 1.183 of the game Soldier of
Fortune II where happens the exception which interrupts the game:
..
0511B3A8 8BB424 58100000 MOV ESI,DWORD PTR SS:[ESP+1058]
0511B3AF 8D4424 18 LEA EAX,DWORD PTR SS:[ESP+18]
0511B3B3 6A 41 PUSH 41
0511B3B5 50 PUSH EAX
0511B3B6 C68424 55100000 >MOV BYTE PTR SS:[ESP+1055],0
0511B3BE FF96 54010000 CALL DWORD PTR DS:[ESI+154]
0511B3C4 8BBC24 64100000 MOV EDI,DWORD PTR SS:[ESP+1064]
..
The ESI register is controlled by the attacker.
The memcpy function described above instead is located at offset 0512aea7.
Proof of Concept:
http://127.0.0.1:80/pbsvweb/plist=1&webkey=aaaaaaaaaaaaa... x1024
ADDITIONAL INFORMATION
The information has been provided by <mailto:aluigi@autistici.org> Luigi
Auriemma.
The original article can be found at:
<http://aluigi.altervista.org/adv/pbwebbof-adv.txt>
http://aluigi.altervista.org/adv/pbwebbof-adv.txt
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
