[NT] Team Factor Remote Server DoS

From: SecuriTeam (support_at_securiteam.com)
Date: 02/25/04

  • Next message: SecuriTeam: "[EXPL] LBreakout2 (Long HOME Environment Variable)" 
    To: list@securiteam.com
Date: 25 Feb 2004 15:55:04 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Team Factor Remote Server DoS
    ------------------------------------------------------------------------

    SUMMARY

    " <http://www.teamfactor.co.uk/> Team Factor is the Special Operations
    action game that takes you to the limits of military endurance and
    endeavor."

    There is a bug in how Team Factor handles incoming packets which can cause
    the game server to crash.

    DETAILS

    Vulnerable Systems:
     * Team Factor version 1.25

    A game packet contains at offset 0x0C a 16-bit parameter which specifies
    the size of the data block following. The value is read simply as a signed
    short which opens the possibility of passing in a negative size. This in
    turn would cause the game to read unallocated memory segments (via
    memcpy() ). The following snippet of code illustrates this:

    :00530D23 0FBF6C240E movsx ebp, word ptr [esp+0E]
    ..
    :00530D6B F3A5 repz movsd

    A proof of concept code to demonstrate the issue can be found at
    <http://aluigi.altervista.org/poc/tfboom.zip>
    http://aluigi.altervista.org/poc/tfboom.zip

    Workaround
    Although the vendor has not supplied a fix the problem is easy to fix.
    Replacing the MOVSX instruction to MOVZX will make the problem go away. A
    small unofficial patch for this problem can be downloaded from
    <http://aluigi.altervista.org/patches/tfboomw125.zip>
    http://aluigi.altervista.org/patches/tfboomw125.zip.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:aluigi@altervista.org> Luigi
    Auriemma.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[EXPL] LBreakout2 (Long HOME Environment Variable)"

    Relevant Pages

    • [NEWS] Gamespy SDK Cd-Key Validation Toolkit Buffer Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Gamespy's CDKey validation toolkit is an SDK ... The problem begins by an overly long reply sent by the game client to the ... int main{ ...
      (Securiteam)
    • [NT] Yager Multiple Vulnerabilities (Multiple Buffer Overflows and DoS)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The game Yager contains multiple buffer overflows that allow attackers to ... Data Block Buffer Overflow: ...
      (Securiteam)
    • [NT] Call Of Duty Broadcast Shutdown DoS Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The game uses special measures in its code to prevent buffer overflows. ... The game uses some anti-buffer-overflow checks that automatically shutdown ... The only official patch available is for the Linux version of the game. ...
      (Securiteam)
    • [NEWS] Serious Game Engine UDP DoS Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Note: The game engine is vulnerable on all supported platforms: Windows, ... of packets to the server, each representing the joining of a new player. ... int main{ ...
      (Securiteam)
    • [NT] Chrome Server Crash When Handling Crafted Packets
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Perspective) shooting game whose takes action on a planet of another solar ... Using a specially crafted packet it is possible to cause the game or game ... unallocated memory, into a pointer with a value of 0x00000000. ...
      (Securiteam)