[ GLSA 200404-12 ] Scorched 3D server chat box format string vulnerability

From: Kurt Lieber (klieber_at_gentoo.org)
Date: 04/09/04

  • Next message: John Sage: "Re: [Full-Disclosure] ron1n phone home, episode 5" 
    Date: Fri, 9 Apr 2004 09:32:24 -0400
To: gentoo-announce@lists.gentoo.org

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Gentoo Linux Security Advisory GLSA 200404-12
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                                 http://security.gentoo.org
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

      Severity: High
         Title: Scorched 3D server chat box format string vulnerability

          Date: April 09, 2004
          Bugs: #39302
            ID: 200404-12

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Synopsis
    ========

    Scorched 3D is vulnerable to a format string attack in the chat box
    that leads to Denial of Service on the game server and possibly allows
    execution of arbitrary code.

    Background
    ==========

    Scorched 3D is a game based loosely on the classic DOS game "Scorched
    Earth". Scorched 3D adds amongst other new features a 3D island
    environment and LAN and internet play. Scorched 3D is totally free and
    is available for multiple operating systems.

    Affected packages
    =================

        -------------------------------------------------------------------
         Package / Vulnerable / Unaffected
        -------------------------------------------------------------------
         games-strategy/scorched3d < 37 >= 37

    Description
    ===========

    Scorched 3D (build 36.2 and before) does not properly check the text
    entered in the Chat box (T key). Using format string characters, you
    can generate a heap overflow. This and several other unchecked buffers
    have been corrected in the build 37 release.

    Impact
    ======

    This vulnerability can be easily exploited to remotely crash the
    Scorched 3D server, disconnecting all clients. It could also
    theorically be used to execute arbitrary code on the server with the
    rights of the user running the server.

    Workaround
    ==========

    A workaround is not currently known for this issue. All users are
    advised to upgrade to the latest version of the affected package.

    Resolution
    ==========

    Scorched 3D users should upgrade to version 37 or later:

        # emerge sync

        # emerge -pv ">=games-strategy/scorched3d-37"
        # emerge ">=games-strategy/scorched3d-37"

    Availability
    ============

    This GLSA and any updates to it are available for viewing at
    the Gentoo Security Website:

         http://security.gentoo.org/glsa/glsa-200404-12.xml

    Concerns?
    =========

    Security is a primary focus of Gentoo Linux and ensuring the
    confidentiality and security of our users machines is of utmost
    importance to us. Any security concerns should be addressed to
    security@gentoo.org or alternatively, you may file a bug at
    http://bugs.gentoo.org.

    License
    =======

    Copyright 2004 Gentoo Technologies, Inc; referenced text
    belongs to its owner(s).

    The contents of this document are licensed under the
    Creative Commons - Attribution / Share Alike license.

    http://creativecommons.org/licenses/by-sa/1.0

  • Next message: John Sage: "Re: [Full-Disclosure] ron1n phone home, episode 5"

    Relevant Pages

    • [Full-Disclosure] [gentoo-announce] [ GLSA 200404-12 ] Scorched 3D server chat box format string vul
      ... Scorched 3D is vulnerable to a format string attack in the chat box ... Scorched 3D is a game based loosely on the classic DOS game "Scorched ... Scorched 3D server, disconnecting all clients. ... Security is a primary focus of Gentoo Linux and ensuring the ...
      (Full-Disclosure)
    • [ GLSA 200404-12 ] Scorched 3D server chat box format string vulnerability
      ... Scorched 3D is vulnerable to a format string attack in the chat box ... Scorched 3D is a game based loosely on the classic DOS game "Scorched ... Scorched 3D server, disconnecting all clients. ... Security is a primary focus of Gentoo Linux and ensuring the ...
      (Bugtraq)
    • Re: World of warcraft NEWBIE Advice Please
      ... >> server, so they can swap things via ingame mail. ... type of game play later, which is good for me as i need more me time on the ... I do think the chat side is great, yahoo / msn should develope there chat ...
      (alt.games.warcraft)
    • Re: obviscating python code for distribution
      ... game; everyone will essentually end up connecting to my server to play the ... I don't really like the idea of security through obscurity, ... server as a test for their new setups. ...
      (comp.lang.python)
    • Re: C# EXE and website integration?
      ... make in the game, and when the game is over I send all these actions ... and their high score to the server. ... actions they made and their high score. ... you could (if security allows) have PHP run the EXE ...
      (microsoft.public.dotnet.languages.csharp)