[NEWS] Sparklet Format String

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Sparklet Format String
------------------------------------------------------------------------


SUMMARY

" <http://sparklet.sourceforge.net/> Sparklet is a multiplayer networking
client-server, top-down view, space shooting game for 2 or more remote
players."

Improper handling of user input allows attackers to execute arbitrary code
using a format string vulnerability in Sparklet.

DETAILS

Vulnerable Systems:
* Sparklet version 0.9.4try3 and prior

The game is affected by a format string vulnerability located in the
function which visualizes the text strings on the client screen during the
match.
The problem is located in agl_text.cpp where is missed the "%s" format
argument:

void WriteText(const Point<float> &DstLoc, const std::string &Text, const
int &Font, const ULONG &Color) {
...
allegro_gl_printf_ex(fnt, x, y, 0, Text.c_str());
...

Through this bug an attacker on a server or a client (the server is not
vulnerable since it simply forwards all the received data to all the
clients connected to it) can crash or execute malicious code versus any
client which is playing on the server.

Proof of Concept:
Use the nickname %n%n%n%n%n

Vendor Status:
A new version will be released soon.


ADDITIONAL INFORMATION

The information has been provided by <mailto:aluigi@xxxxxxxxxxxxx> Luigi
Auriemma.
The original article can be found at:
<http://aluigi.altervista.org/adv/sparkletfs-adv.txt>
http://aluigi.altervista.org/adv/sparkletfs-adv.txt



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [NT] Horde Multiple XSS
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... based on PHP and the Horde Framework." ... Horde is subject to a client side script injection vulnerability in the ...
    (Securiteam)
  • [NEWS] Doomsday Format String
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Doomsday engine is vulnerable to a Format String vulnerability, ... buffer = malloc; ...
    (Securiteam)
  • [UNIX] EMC Dantz Retrospect Backup DoS
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... EMC Dantz Retrospect Backup DoS ... EMC Dantz Retrospect is a network backup client ...
    (Securiteam)
  • [NT] McAfee WebShield SMTP Format String
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A format string vulnerability exists within the McAfee WebShield SMTP ...
    (Securiteam)
  • [NT] SafeNet SoftRemote VPN Client Clear-text Password in Memory
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... SoftRemote VPN client: The SoftRemote client stores the password in an ... The SafeNet SoftRemote VPN client is widely used for remote access IPsec ... system to obtain a physical memory dump. ...
    (Securiteam)