[NEWS] Soldier of Fortune II DoS Vulnerability (/ignore command)

From: SecuriTeam (support_at_securiteam.com)
Date: 06/30/05

  • Next message: SecuriTeam: "[TOOL] Snortcheck Tool: Check If Snort It's Running" 
    To: list@securiteam.com
Date: 30 Jun 2005 15:19:33 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Soldier of Fortune II DoS Vulnerability (/ignore command)
    ------------------------------------------------------------------------

    SUMMARY

     <http://sof2.ravensoft.com/> Soldier of Fortune II is :a widely played
    FPS game developed by Raven Software and released at May 2002".

    A DoS vulnerability in Soldier Of Fortune allows remote attackers to cause
    the clients to crash when they are given a higher number then 1024.

    DETAILS

    Vulnerable Systems:
     * Soldier of Fortune II version 1.03
     * Soldier of Fortune II version 1.02x

    The /ignore command is used for saying to the server that the client don't
    want to receive the messages of a specific user. The command is followed
    by a number that identifies the ID of the client we want to ignore. This
    client ID is then used by the server for positioning into the g_entities
    array composed by 1024 entities so if we specify a big ID like 123456789
    the server will crash immediately because it tries to access a zone of
    memory not allocated.

    This is an in-game bug so the bug cannot be exploited if the attacker is
    banned or the server is protected by a password not known by him.

    Vendor Status:
    The game is no longer maintained by the vendor.

    Workaround:
    The correct way for removing the problem is patching the bug into the
    latest SDK available for the game (1.02 + 1.03) and recompiling it. The
    patch consists in the adding of the following instruction in g_cmds.c
    after "ignoree = atoi( buffer );" at line 1962:

     if(ignoree > MAX_GENTITIES) return;

    It's enough to compile only the game folder (game.bat) and then zip the
    file vm\sof2mp_game.qvm in a new pk3 file like update_fix.pk3.
    Instead another and probably simplest way is just that of modifying the
    file vm\sof2mp_game.qvm removing the /ignore command.

    The easy step-by-step is explained here:
     <http://aluigi.altervista.org/patches/q3lamefix.txt>
    http://aluigi.altervista.org/patches/q3lamefix.txt

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:aluigi@autistici.org> Luigi
    Auriemma.
    The original article can be found at:
    <http://aluigi.altervista.org/adv/sof2ignore-adv.txt>
    http://aluigi.altervista.org/adv/sof2ignore-adv.txt

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[TOOL] Snortcheck Tool: Check If Snort It's Running"

    Relevant Pages

    • [NEWS] Sauerbraten Engine Multiple Vulnerabilities (Exploit)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The problem, which affects both server and clients, is that this code ... C] Clients Crash Through Invalid Map ... When a client ...
      (Securiteam)
    • [NEWS] Cube Engine Multiple Vulnerabilities (Exploit)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The problem, which affects both server and clients, is that this code ... C] Clients Crash through Invalid Map ... client tries to load an invalid map file it will exit immediately showing ...
      (Securiteam)
    • [UNIX] Multiple up-imapproxy DoS Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... connections open after client has logged out, ... allows attacker to cause the server to crash by sending them when they ... extern void HandleRequest(int); ...
      (Securiteam)
    • [NT] Multiple vulnerabilities in Hired Team: Trial
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Hired Team is a nice FPS game developed by New Media ... allows an attacker to join a server (that doesn't have password support, ... Each time a new player joins, the server assigns an UDP port to him ...
      (Securiteam)
    • [NEWS] Soldier Of Fortune II Format String (Through PunkBuster)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... PB for server version 1.180 and prior ... players who use invalid cvars, for example with values outside the range ... The message sent to the client contains both the name of the monitored ...
      (Securiteam)