[Full-disclosure] Broadcast format string and buffer-overflow in Race Driver 1.20

From: Luigi Auriemma (aluigi_at_autistici.org)
Date: 07/18/05

  • Next message: Amit Klein (AKsecurity): "[Full-disclosure] NTLM HTTP Authentication is insecure by design - a new writeup by Amit Klein" 
    Date: Mon, 18 Jul 2005 18:40:38 +0000
To: bugtraq@securityfocus.com, bugs@securitytracker.com, news@securiteam.com, full-disclosure@lists.grok.org.uk, vuln@secunia.com

    #######################################################################

                                 Luigi Auriemma

    Application: Race Driver
                  http://www.codemasters.com/tocaracedriver/
    Versions: <= 1.20
    Platforms: Windows
    Bugs: A] broadcast format string
                  B] broadcast buffer-overflow
    Exploitation: remote, versus any user in the public chat or through
                  malformed server replies (broadcast)
    Date: 18 Jul 2005
    Author: Luigi Auriemma
                  e-mail: aluigi@autistici.org
                  web: http://aluigi.altervista.org

    #######################################################################

    1) Introduction
    2) Bug
    3) The Code
    4) Fix

    #######################################################################

    ===============
    1) Introduction
    ===============

    Race Driver is a funny but poorly supported racing game developed and
    published by Codemasters (http://www.codemasters.com).
    It has been released in March 2003.

    #######################################################################

    ======
    2) Bug
    ======

    Race Driver incorrectly uses sprintf() for building different types of
    text strings usually used for the visualization of the data.
    The places where this bad sprintf() can be exploited are at least 2:
    the public chat hosted on the encrypted IRC server peerchat.gamespy.com
    and the in-game server browser.

    The public chat is a place used by Race Driver while the users wait for
    a free server to join. The users automatically join it when they choose
    to play on Internet from the Network menu... it is an useless but
    forced stage.
    Other than the messages in the channel the game supports also the
    private messages (whispers) so an attacker can decide to attack a
    specific user or just all the users in the room.

    The in-game server browser instead is where are showed and ordered the
    online servers through the informations received in their replies.

    The sprintf() function is affected by two bugs: a format string and a
    buffer-overflow caused by text strings of 264 chars.

    #######################################################################

    ===========
    3) The Code
    ===========

    For testing the bugs through the chat is enough to use the same game or
    an IRC client with a Peerchat proxy.
    The example chat messages (or also nicknames) for exploiting the bugs
    are the following:
       %n%n%n
     and
      
    aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
    aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
    aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
    aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaRETA

    The raw names of the channels used by Race Driver are: #GPG!511 (the
    main), #GPG!510, #GPG!508, #GPG!507, #GPG!506, #GPG!509, #GPG!513,
    #GPG!512, #GPG!485, #GPG!486 and (for some milliseconds)
    #GSP!racedriver

    For testing the bugs through a malicious server you need only to host a
    game with the name %n%n%n.

    #######################################################################

    ======
    4) Fix
    ======

    This game is no longer supported.

    #######################################################################

    ---
    Luigi Auriemma
    http://aluigi.altervista.org
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: Amit Klein (AKsecurity): "[Full-disclosure] NTLM HTTP Authentication is insecure by design - a new writeup by Amit Klein"

    Relevant Pages