The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Sparklet Format String
------------------------------------------------------------------------
SUMMARY
" <http://sparklet.sourceforge.net/> Sparklet is a multiplayer networking
client-server, top-down view, space shooting game for 2 or more remote
players."
Improper handling of user input allows attackers to execute arbitrary code
using a format string vulnerability in Sparklet.
DETAILS
Vulnerable Systems:
* Sparklet version 0.9.4try3 and prior
The game is affected by a format string vulnerability located in the
function which visualizes the text strings on the client screen during the
match.
The problem is located in agl_text.cpp where is missed the "%s" format
argument:
void WriteText(const Point<float> &DstLoc, const std::string &Text, const
int &Font, const ULONG &Color) {
...
allegro_gl_printf_ex(fnt, x, y, 0, Text.c_str());
...
Through this bug an attacker on a server or a client (the server is not
vulnerable since it simply forwards all the received data to all the
clients connected to it) can crash or execute malicious code versus any
client which is playing on the server.
Proof of Concept:
Use the nickname %n%n%n%n%n
Vendor Status:
A new version will be released soon.
ADDITIONAL INFORMATION
The information has been provided by <mailto:aluigi@autistici.org> Luigi
Auriemma.
The original article can be found at:
<http://aluigi.altervista.org/adv/sparkletfs-adv.txt>
http://aluigi.altervista.org/adv/sparkletfs-adv.txt
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
