The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
NeoEngine Multiple Vulnerabilities (Format String, DoS)
------------------------------------------------------------------------
SUMMARY
" <http://www.neoengine.org/> NeoEngine is an Open Source 3D game engine,
currently available in two flavors"
Improper handling of user input allows attackers to execute arbitrary code
using a Format string, and to crash NeoEngine.
DETAILS
Vulnerable Systems:
* NeoEngine version 0.8.2
* NeoEngine version CVS 3422
Format String:
The visualization functions used in NeoEngine are affected by some format
string vulnerabilities caused by the absence of the format argument:
From neoengine/console.cpp:
bool Console::Render( Frustum *pkFrustum, bool bForce )
...
m_pkFont->Printf( m_iX + m_iWidth - 2, m_iY + iHeight,
strCmd.c_str() );
...
m_pkFont->Printf( m_iX + 4, m_iY + iHeight, strCmd.c_str() );
...
From neowtk/textarea.cpp:
bool TextArea::Render( Frustum *pkFrustum, bool bForce )
...
if( !m_bPassword )
m_pkFont->Printf( kPos.x + m_kPadding.x, kPos.y +
m_kPadding.y, m_strText.c_str() );
else
m_pkFont->Printf( kPos.x + m_kPadding.x, kPos.y +
m_kPadding.y, string( m_strText.length(), '*' ).c_str() );
DoS:
It's possible to crash the engine through a too big uiMessageLength value
(32 bit number) which causes the assignment of a NULL pointer to the
pucMessage pointer and the subsequent reading from the socket without
verifying the return value.
From neonet/core.cpp:
void Core::Receive()
...
unsigned int uiMessageLength;
...
if ( pkTCPSocket->Read( &uiMessageLength, sizeof( unsigned int ) ) <=
0 )
...
char *pucMessage;
pucMessage = ( char* )malloc( uiMessageLength + 1 );
if ( uiMessageLength > 0 )
{
pkTCPSocket->Read( pucMessage, uiMessageLength );
}
pucMessage[ uiMessageLength ] = 0;
Message *pkMessage = pkMessageTemplate->Deserialize( string(
pucMessage, uiMessageLength ) );
free( pucMessage );
ADDITIONAL INFORMATION
The information has been provided by <mailto:aluigi@autistici.org> Luigi
Auriemma.
The original article can be found at:
<http://aluigi.altervista.org/adv/neoenginex-adv.txt>
http://aluigi.altervista.org/adv/neoenginex-adv.txt
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
