bugtraq - Medieval Total War <= 1.1 broadcast crash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 7 Oct 2003 17:33:21 +0000
From: Luigi Auriemma <aluigi@...ervista.org>
To: bugtraq@...urityfocus.com
Subject: Medieval Total War <= 1.1 broadcast crash

#######################################################################

                             Luigi Auriemma

Application:  Medieval Total War
              http://www.totalwar.com
Versions:     <= 1.1
Platforms:    Windows
Bug:          Remote crash of server and attached clients caused by
              long nickname
Risk:         Low/Medium
Author:       Luigi Auriemma
              e-mail: aluigi@...ervista.org
              web:    http://aluigi.altervista.org

#######################################################################

1) Introduction
2) Bug
3) The Code
4) Fix

#######################################################################

===============
1) Introduction
===============

Medieval Total War is a real-time strategy game available on PC and is
developed by Creative Assembly.

#######################################################################

======
2) Bug
======

The MTW's players have access to the server only in a specific moment
and not during the execution of the game.
This moment is the Lobby screen before the starting of the match where
all the players can join.

The bug is in the management of the nicknames sent by the clients, in
fact a nickname longer than 76 unicode chars causes the immediate crash
of the server and of all the connected clients.

The problem seems to be in the access to unreacheable memory, and the
following is the instruction where happens the crash (using 76 chars):

:0x6b96f8     mov    eax,DWORD PTR [edx]

Both EAX and EDX are equal to 0.

Longer nicknames cause exceptions in other instructions but the problem
is ever the access to unreacheable memory.

In my tests doesn't seem possible to execute code because the registers
that are overwritten by the data are not important to change the
execution flow.

Side note: on Win98SE I have seen that a very long nickname (at least
250 unicode chars) causes a blue screen of the death.

#######################################################################

===========
3) The Code
===========

I have written a simple proof-of-concept that also lets you to specify
the amount of unicode chars to use in the nickname field.
Use a number major or equal than 76:

http://aluigi.altervista.org/poc/mtwdos-server.zip

#######################################################################

======
4) Fix
======

No fix.
I have contacted Creative Assembly a lot of months ago but they didn't
have the resources to patch these bugs.

#######################################################################

--- 
Luigi Auriemma
http://aluigi.altervista.org