Date: Wed, 27 Oct 2004 13:18:06 +0100
From: "Richard Stanway" <bugtraq@...ur1ty.net>
To: <bugtraq@...urityfocus.com>
Subject: Multiple Vulnerabilites in Quake II Server


Multiple Vulnerabilites in Quake II Server
==========================================
Product: Quake II
Version: Tested on 3.2x, likely all
 Vendor: iD Software (http://www.idsoftware.com/)
   Date: 2004-10-27
   Risk: High (possible remote code execution)
    URL: http://secur1ty.net/advisories/001

Background
==========
Quake  II is  a multiplayer  game featuring  around 750  active  servers
online.  Quake  II   was  open  sourced   in  December  2001   and  many
modifications have since been made.

As the Quake  II engine is  available for commercial  licensing, some of
these  issues may  affect other  games based  on the  Quake II   engine,
including (but not limited to):

 * Anachronox
 * Daikatana
 * Heretic II
 * Kingpin: Life of Crime
 * Soldier of Fortune
 * Sin

Source: http://en.wikipedia.org/wiki/Quake_II

Issues
======
Due to unchecked input at various stages in the server, remote users are
able to  cause  the  server to   crash, reveal sensitive  information or
potentially execute arbitrary code.

Problem #1 - Array bounds error
===============================
During  the  processing of  Configstrings  and Baselines used during the
connection process,  the  Quake II client is expected to send the offset
of the  array it  wants to   receive. However,  no checking  is done  to
ensure  that  this  offset  is  not  negative,  resulting  in  an access
violation  when the server attempts to  read this memory.

Problem #2 - Buffer overflow when parsing packets
=================================================
Upon receiving  a command  packet, the  server will  attempt to split it
into chunks such as cmd_args  (everything after the function name),  and
generating an  array  called  cmd_argv  so   that functions  can  easily
access parameters of the command.  The buffer designed to hold  cmd_args
is  only 1024 bytes while the maximum packet size is in the 1400+  bytes
range. No  checks are  made to  verify the  string length  before it  is
copied into the cmd_args  buffer,   resulting in   a  buffer   overflow.

Depending  on the system architecture exploitation may be possible,  but
is limited by  the fact that cmd_args resides in the data section of the
executable. A typical overflow  will corrupt the cmd_functions  pointer,
causing execution of further commands  to crash the server. This  attack
can be performed without  having to connect to  the Quake II server  and
requires only  a single  UDP packet  which may  allow for source address
spoofing.

Problem #3 - Win32 server auto downloading allows leak
             of sensitive files
======================================================
Quake II allows users to download content from the server that they need
to play, such as custom maps. However the server does not perform enough
verification on the path supplied by the client for downloading. Due  to
the  nature of  Win32 paths,  it is  possible to  specify for  example,
"download \/server.cfg"  as a  command which  will result  in the server
sending  the file  server.cfg from  the mod  directory which  would not
normally be allowed.

Problem #4 - Linux server auto downloading DoS
==============================================
Linux  behaves  differently  to  Win32 when  a  file  open  operation is
attempted on a directory. Due  to insufficient checking of the  path, it
is  possible to  send a  command such  as "download  /maps/" which  will
result  in  the  server  opening  the  maps  directory  and subsequently
shutting down when it cannot read data from it.

Problem #5 - Fake clients DoS
=============================
Due to high timeout values and no limit of connections from a single IP,
it  is  possible to  cause  the Quake  II  server to  refuse  legitimate
connections by filling it with "fake" clients. Only 2 UDP packets   need
to be sent  to initiate a  connection, which will  then occupy a  player
slot and take up to 2 minutes by default to time out. As no limiting per
IP is done, a single 56k modem user could easily occupy 40+ client slots
using this method.

Reference: http://aluigi.altervista.org/fakep.htm

Problem #6 - IP Spoofing
========================
The  Quake II  client constructs  a string  known as  the userinfo  that
contains  key/value pairs   of important  settings, such  as the  player
name,  skin, etc.   When the   server  reads  the client's  userinfo  it
inserts a new key/value pair called "ip"  with the client's IP   address
to allow mods to see the client IP when they look at the userinfo.

It is possible  to construct a  client userinfo string large  enough  so
that   a key/value  pair will  be truncated.   By then  inserting a  key
called "ip", it  is possible  to  trick  a mod  into reading  the  wrong
IP from   the userinfo. Since it  is the responsibility  of mods to  ban
users from   the server,  a malicious  user can  evade any  bans on  the
server.

Problem #7 - Damage of client state structure
=============================================
By  not  properly issuing  a  disconnect command,  a  client can  remain
connected  to a  server even  after supposedly  disconnecting. When  the
client  reconnects,  the  server  will  try  to  find  a  slot  that was
previously allocated to  that client and  re-use  it.  However  no check
is done to  ensure that this slot is truly no longer in use,   resulting
in overwriting  of  any  old client  state  without  notifying the   mod
which can  result in client  cleanup code not  running and  inconsistent
player counts amongst other mod-specific issues.

Problem #8 - Local buffer overflows
===================================
A number of functions designed to be executed from the server console or
rcon do not properly check  buffer sizes, resulting in a  crash. However
since these can only be exploited from someone with direct access to the
server, they are a low threat.

I would also like to remind  server admins that the original version  of
the Quake II server (still in use by approximately 260 servers according
to the All-Seeing Eye) has even  larger risks as it is trivial  to steal
the rcon  password and  perform actions  as if  you were  at the  server
console, including browsing of the host system directory structure.

Reference: http://seclists.org/lists/bugtraq/2002/May/0127.html

Vendor Response
===============
As the product is  now open source, it  is not expected that  the vendor
will release any official updates. Previous vulnerabilities in Quake  II
have not warranted any vendor response.

Workaround
==========
Disabling  auto  downloading  (allow_download  0)  will  mitigate   some
threats, but most of the issues listed cannot be worked around.

Fix
===
It is  strongly recommended  that any  Quake II  server operators use an
updated  Quake   II  binary   to  fix   these  issues.   At present, the
only known   client/server modification  which  contains  fixes  for all
these issues is R1Q2, available at http://www.r1ch.net/stuff/r1q2/

Credits
=======
Thanks to posters on the  QuakeSrc.org message boards for bringing  some
of these issues to light.

Richard Stanway
http://www.r1ch.net/

Powered by blists - more mailing lists