[NEWS] Format String in Netrek

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Format String in Netrek
------------------------------------------------------------------------


SUMMARY

<http://www.netrek.org/> Netrek is a well known real-time strategy game
inspired to Star Trek.

A format string vulnerability was discovered in the Netrek game server.

DETAILS

Vulnerable Systems:
* Netrek versions 2.12.0 and prior. (Vanilla server)

Immune Systems:
* Netrek version 2.12.1

The Vanilla server is affected by a format string vulnerability caused by
the calling of the pmessage2() function without the needed format
argument.

The bug is located in new_warning() and can be exploitated through the
locking of a player (the same attacker too) who is using a malformed
nickname.

Note that the EVENTLOG switch must be enabled for exploiting this
vulnerability (default is disabled).

from ntserv/warning.c:
void new_warning(int index, const char *fmt, ...) {

char temp[150];

va_list args;
va_start(args, fmt);

vsprintf(temp, fmt, args);

...

if (eventlog) {

char from_str[9]="WRN->\0\0\0";

strcat(from_str, me->p_mapchars);
pmessage2(0, 0, from_str, me->p_no, temp);
}

Proof of concept:
<http://aluigi.org/poc/netrekfs.zip> http://aluigi.org/poc/netrekfs.zip


ADDITIONAL INFORMATION

The information has been provided by <mailto:aluigi@xxxxxxxxxxxxx> Luigi
Auriemma.
The original article can be found at:
<http://aluigi.org/adv/netrekfs-adv.txt>
http://aluigi.org/adv/netrekfs-adv.txt



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages