[NEWS] Alien Arena's Multiple Vulnerabilities



The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Alien Arena's Multiple Vulnerabilities
------------------------------------------------------------------------


SUMMARY

<http://red.planetarena.org> Alien Arena 2006 GE is the latest release of
the CodeRED series, an open source game developed on an enhanced version
(CRX engine) of the GPLed Quake II engine. The game supports both LAN and
Internet multiplayer.

Multiple vulnerabilities discovered in Alien Arena. All the
vulnerabilities need to be exploited in-game so the attacker should be
have the password if it's password protected, as well as not banned.

DETAILS

Vulnerable Systems:
* Alien Arena 2006 Gold Edition versions 5.00 and previous

Server format string (safe_cprintf):
The safe_cprintf() function used by the server for sending messages to the
clients is affected by a format string vulnerability which could allow the
execution of malicious code. After having built the output string the
function passes it as format argument (yes it's just like a double
sprintf) to gi.cprintf() -> "void PF_cprintf (edict_t *ent, int level,
char *fmt, ...)".

From games/acesrc/acebot_cmds.c:
void safe_cprintf (edict_t *ent, int printlevel, char *fmt, ...)
{
char bigbuffer[0x10000];
va_list argptr;
int len;

if (ent && (!ent->inuse || ent->is_bot))
return;

va_start (argptr,fmt);
len = vsprintf (bigbuffer,fmt,argptr);
va_end (argptr);

gi.cprintf(ent, printlevel, bigbuffer);

}

Server buffer-overflow (Cmd_Say_f):
The function Cmd_Say_f is used by the server for handling the text
messages received from the clients. Cmd_Say_f uses a buffer of 2048 bytes
in which puts the nickname of the player who has sent the message using
the secure (enough secure) Com_sprintf() function followed by strcat() for
appending the received message. These instructions allow an attacker to
exploit the resulted buffer-overflow for executing malicious code.

From source/game/g_cmds.c:
void Cmd_Say_f (edict_t *ent, qboolean team, qboolean arg0)
{
int i, j;
edict_t *other;
char *p;
char text[2048];
gclient_t *cl;

if (gi.argc () < 2 && !arg0)
return;

if ((!((int)(dmflags->value) & (DF_MODELTEAMS | DF_SKINTEAMS))) ||
(!ctf->value))
team = false;

if (team)
Com_sprintf (text, sizeof(text), "(%s): ", ent->client->pers.netname);
else
Com_sprintf (text, sizeof(text), "%s: ", ent->client->pers.netname);

if (arg0)
{
strcat (text, gi.argv(0));
strcat (text, " ");
strcat (text, gi.args());
}
else
{
p = gi.args();

if (*p == '"')
{
p++;
p[strlen(p)-1] = 0;
}
strcat(text, p);
}
...

Crash (Com_sprintf):
The Com_sprintf() function is a custom snprintf() replacement widely used
in the code. The only problem of this function (usually bigbuffer is big
enough so it doesn't represent a risk) is caused by the final strncpy()
call which is not followed by an instruction for delimiting dest with a
NULL byte. Often, depending by the system/compiler, this lack leads to a
crash. In my tests I were able to crash the precompiled Windows clients
without problems through a skin of about 110 chars (MAX_OSPATH is 128). In
fact one of the best ways for exploiting this bug is just using a player
with a long skin, weapon or model name so any client which is inside or
will join the server while the attacker is playing will be crashed
immediately. In this case we can watch the exploitation in the function
CL_LoadClientinfo() located in client/cl_parse.c.

From source/game/q_shared.c:
void Com_sprintf (char *dest, int size, char *fmt, ...)
{
int len;
va_list argptr;
char bigbuffer[0x10000];

va_start (argptr,fmt);
len = vsprintf (bigbuffer,fmt,argptr);
va_end (argptr);
if (len >= size)
Com_Printf ("Com_sprintf: overflow of %i in %i\n", len, size);
strncpy (dest, bigbuffer, size-1);
}

Proof of Concept:
<http://aluigi.altervista.org/poc/aa2k6x.zip>
http://aluigi.altervista.org/poc/aa2k6x.zip

Fix:
No fix so far. The developers will release a patch in the next months.


ADDITIONAL INFORMATION

The information has been provided by <mailto:aluigi@xxxxxxxxxxxxx> Luigi
Auriemma.
The original article can be found at:
<http://aluigi.altervista.org/adv/aa2k6x-adv.txt>
http://aluigi.altervista.org/adv/aa2k6x-adv.txt



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.



Relevant Pages

  • [UNIX] Multiple Overflows in Spider
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The first vulnerability is a heap overflow. ... char *str; ... Both vulnerabilities can be exploited by a local attacker to gain ...
    (Securiteam)
  • [NEWS] Ventrilo Denial of Service
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Lack of proper packet handling within Ventrilo allow attackers to crash ... void ventrilo_udp_head_dec(unsigned char *data) ... void ventrilo_udp_data_dec(unsigned char *data, int len, unsigned short ...
    (Securiteam)
  • [EXPL] Microworld Mailscan Password Revealer (Exploit)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Employing an array of intelligent filters, MailScan offers ... int main(int argc, char *argv) ...
    (Securiteam)
  • [EXPL] Windows Lsasrv.dll Remote Universal Exploit (MS04-011)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... unsigned char reverseshell[] = ... int num; ... len = recv(sockfd, recvbuf, 1600, 0); ...
    (Securiteam)
  • [EXPL] Internet Explorer VML Buffer Overflow Download Exec (Exploit)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... char *url = NULL; ... int size) ...
    (Securiteam)