bugtraq - Clients broadcast buffer overflow in Red Faction <= 1.20

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 1 Mar 2004 15:11:18 +0000
From: Luigi Auriemma <aluigi@...ervista.org>
To: bugtraq@...urityfocus.com, bugs@...uritytracker.com,
	news@...uriteam.com
Subject: Clients broadcast buffer overflow in Red Faction <= 1.20

#######################################################################

                             Luigi Auriemma

Application:  Red Faction
              http://www.redfaction.com
Versions:     <= 1.20
Platforms:    Windows, MacOS
Bug:          broadcast client buffer overflow
Risk:         highly critical
Exploitation: remote and automatic, versus clients
Date:         01 Mar 2004
Author:       Luigi Auriemma
              e-mail: aluigi@...ervista.org
              web:    http://aluigi.altervista.org

#######################################################################

1) Introduction
2) Bug
3) The Code
4) Fix

#######################################################################

===============
1) Introduction
===============

Red Faction is a very cool FPS game developed by Volition
(http://www.volition-inc.com).
The main and most famous feature of this game is the possibility to
destroy walls and other scenario's elements with bombs and rocket
launchers... very funny and relaxing.

#######################################################################

======
2) Bug
======

The problem is a broadcast client buffer overflow.
Each client entering in the multiplayer menu of the game first contacts
the master server to know what game servers are online and then asks
informations to eachone of them.
The reply of the servers contains a NULL terminated text string
identifying the server name, if this string is major or equal than 260
chars the client will be victim of a buffer overflow vulnerability
caused by the following memcpy() function (from 1.20 version):

:0047B2D8 F3A5                    rep movsd

The attacker on the (passive) server will have full control over any
client.

#######################################################################

===========
3) The Code
===========

http://aluigi.altervista.org/poc/rfcbof.zip

#######################################################################

======
4) Fix
======

No fix.
No replies from developers.

#######################################################################

--- 
Luigi Auriemma
http://aluigi.altervista.org