#######################################################################
Luigi Auriemma
Application: Scrapland
http://www.scrapland.com
Versions: <= 1.0
Platforms: Windows
Bug: server termination
Exploitation: remote, versus server (partially in-game)
Date: 28 Feb 2005
Author: Luigi Auriemma
e-mail: aluigi@autistici.org
web: http://aluigi.altervista.org
#######################################################################
1) Introduction
2) Bug
3) The Code
4) Fix
#######################################################################
===============
1) Introduction
===============
Scrapland is the known game developed by MercurySteam Entertainment
(http://www.mercurysteam.com) with the creative support of American
McGee (http://www.americanmcgee.com).
The game has been released at the beginning of 2005.
#######################################################################
======
2) Bug
======
The main problem of the game is that the server terminates after any
error instead of simply showing the error message in the game console
and continuing its work.
This situation lets an attacker to easily crash a Scrapland game server
in many ways, some of them are:
- size>SSize: the game uses 8 bits numbers to specify the size of the
text strings inside the packets. These 8 bits numbers are handled as
signed integers so any value bigger than 127 causes the server error.
- unexistent model: if the client uses a model (like engine, pilot or
player) not available on the server, this one will terminate saying
that the model specified by the client has not been found.
- newpos<=size: another type of error.
- access violation caused by the reception of two partial packets.
If the server is full, is not possible to terminate it.
#######################################################################
===========
3) The Code
===========
http://aluigi.altervista.org/poc/scrapboom.zip
#######################################################################
======
4) Fix
======
No fix.
No reply from the developers.
#######################################################################
---
Luigi Auriemma
http://aluigi.altervista.org
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
