Broadcast crash in Xpand Rally 1.0.0.0

From: Luigi Auriemma (aluigi_at_autistici.org)
Date: 01/30/05

  • Next message: Luke Macken: "[ GLSA 200501-45 ] Gallery: Cross-site scripting vulnerability" 
    Date: Sun, 30 Jan 2005 20:26:11 +0000
To: bugtraq@securityfocus.com, bugs@securitytracker.com, news@securiteam.com, full-disclosure@lists.netsys.com, vuln@secunia.com

    #######################################################################

                                 Luigi Auriemma

    Application: Xpand Rally
                  http://www.xpandrally.com
    Versions: 1.0.0.0
    Platforms: Windows
    Bug: reading and writing on unallocated memory (crash)
    Exploitation: remote, versus server and clients (broadcast)
    Date: 30 Jan 2005
    Author: Luigi Auriemma
                  e-mail: aluigi@autistici.org
                  web: http://aluigi.altervista.org

    #######################################################################

    1) Introduction
    2) Bug
    3) The Code
    4) Fix

    #######################################################################

    ===============
    1) Introduction
    ===============

    Xpand Rally is the recent rally game developed by Techland
    (http://www.techland.pl) and released in September 2004.

    #######################################################################

    ======
    2) Bug
    ======

    The problem is caused by an unchecked memory allocation controlled by
    the attacker that can decide the exact amount of data to allocate
    through a 32 bits number in his packets.

    If the memory to allocate is too big the malloc() function will fail
    and no instructions will check it so the game will try to write into a
    bad memory zone (0x00000000)

    Instead if the number is enough big but can be allocated, memcpy() will
    fail because will try to read the unallocated memory after the packet's
    data.

    Naturally also clients are affected and a malicious server visible in
    the master server list is able to passively crash any vulnerable client
    in the world.

    #######################################################################

    ===========
    3) The Code
    ===========

    http://aluigi.altervista.org/poc/xprallyboom.zip

    #######################################################################

    ======
    4) Fix
    ======

    Version 1.1.0.0.

    #######################################################################

    ---
    Luigi Auriemma
    http://aluigi.altervista.org

  • Next message: Luke Macken: "[ GLSA 200501-45 ] Gallery: Cross-site scripting vulnerability"