Quake 2 Lithium Mod V 1.24 Macro Expansion Vuln?

Well I ran quake 2 (using Lithium mod V 1.24) under OllyDBG and it seems that 
the
lithium II mod for quake 2 (latest PATCH 3.20) is parsing the '%' in
nicks. My well crafted nickname '%999f%f%f%f%f' is being pushed onto
the stack as
004144A1 |. 68 E821AF00 PUSH QUAKE2.00AF21E8 ;
ASCII "0.000000 0.000000 0.000000"

A huge real number. This expansion seems to be causing a stack
overflow. I ran it on my test server and sure enough it crashes. I'm currently 
working on code executing and the ability to read any memory address.

I contacted the creator of Lithium mod II , he still hasn't returned my emails.


I found that any 'percent' in the nick is interpreted as 0.0000 you
can use various combo's such as %d for int %c for a char. This is
telling me that it's a format string vulnerability.

This only works on lithium quake 2 server. It's manifested in the
latest release V 1.24. Probably affects prior versions also.

I am currently Reverse Engineering the mod to Get more info on this. Probably 
gonna take a while cause I'm at my mom's house with 8 people and one computer ;p

The vuln lies in the code that updates the score (frags) when you die, the 
overflow will manifest. I will write a more detailed explanation on this after 
I finish RE'ing it.

Regards, SinNULL


More info on the vuln will be posted shortly. When I find some allocated time 
to work with.