[NT] Team Factor Remote Server DoS

• Previous message: SecuriTeam: "[UNIX] Bochs HOME Environment Variable Buffer Overflow"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: list@securiteam.com
Date: 25 Feb 2004 15:55:04 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

  Team Factor Remote Server DoS
------------------------------------------------------------------------

SUMMARY

" <http://www.teamfactor.co.uk/> Team Factor is the Special Operations
action game that takes you to the limits of military endurance and
endeavor."

There is a bug in how Team Factor handles incoming packets which can cause
the game server to crash.

DETAILS

Vulnerable Systems:
 * Team Factor version 1.25

A game packet contains at offset 0x0C a 16-bit parameter which specifies
the size of the data block following. The value is read simply as a signed
short which opens the possibility of passing in a negative size. This in
turn would cause the game to read unallocated memory segments (via
memcpy() ). The following snippet of code illustrates this:

:00530D23 0FBF6C240E movsx ebp, word ptr [esp+0E]
..
:00530D6B F3A5 repz movsd

A proof of concept code to demonstrate the issue can be found at
<http://aluigi.altervista.org/poc/tfboom.zip>
http://aluigi.altervista.org/poc/tfboom.zip

Workaround
Although the vendor has not supplied a fix the problem is easy to fix.
Replacing the MOVSX instruction to MOVZX will make the problem go away. A
small unofficial patch for this problem can be downloaded from
<http://aluigi.altervista.org/patches/tfboomw125.zip>
http://aluigi.altervista.org/patches/tfboomw125.zip.

ADDITIONAL INFORMATION

The information has been provided by <mailto:aluigi@altervista.org> Luigi
Auriemma.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Previous message: SecuriTeam: "[UNIX] Bochs HOME Environment Variable Buffer Overflow"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

• [NEWS] Gamespy SDK Cd-Key Validation Toolkit Buffer Overflow
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... Gamespy's CDKey validation
  toolkit is an SDK ... The problem begins by an overly long reply sent by the game client
  to the ... int main{ ... (Securiteam)
• [NT] Yager Multiple Vulnerabilities (Multiple Buffer Overflows and DoS)
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... The game Yager contains
  multiple buffer overflows that allow attackers to ... Data Block Buffer Overflow: ...
  (Securiteam)
• [NT] Call Of Duty Broadcast Shutdown DoS Vulnerability
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... The game uses special measures
  in its code to prevent buffer overflows. ... The game uses some anti-buffer-overflow checks that
  automatically shutdown ... The only official patch available is for the Linux version
  of the game. ... (Securiteam)
• [NEWS] Serious Game Engine UDP DoS Vulnerability
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... Note: The game engine is
  vulnerable on all supported platforms: Windows, ... of packets to the server, each representing
  the joining of a new player. ... int main{ ... (Securiteam)
• [NT] Chrome Server Crash When Handling Crafted Packets
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... Perspective) shooting game
  whose takes action on a planet of another solar ... Using a specially crafted packet it
  is possible to cause the game or game ... unallocated memory, into a pointer with a value
  of 0x00000000. ... (Securiteam)