lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 1 Oct 2007 21:31:38 +0200
From: Luigi Auriemma <aluigi@...istici.org>
To: bugtraq@...urityfocus.com, bugs@...uritytracker.com,
	news@...uriteam.com, full-disclosure@...ts.grok.org.uk,
	vuln@...unia.com, packet@...ketstormsecurity.org
Subject: Unexploitable buffer-overflow in America's Army 2.8.2 through PB


#######################################################################

                             Luigi Auriemma

Application:  America's Army and America's Army Special Forces
              http://www.americasarmy.com
Versions:     <= 2.8.2
Platforms:    Windows, Linux and Mac
Bugs:         unexploitable buffer-overflow in the logging function
Exploitation: remote, versus servers with Punkbuster enabled
Date:         01 Oct 2007
Author:       Luigi Auriemma
              e-mail: aluigi@...istici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


America's Army is a realistic FPS game based and developed just by the
the U.S. Army (http://www.goarmy.com).


#######################################################################

======
2) Bug
======


This bug is the same reported here:

  http://aluigi.org/adv/unrwebdos-adv.txt

What changes now is the possibility of exploiting it also in this
specific game (since it doesn't support or doesn't seem to support the
web service used as way for exploiting the bug in that advisory) and
anonymously from outside the server with a single UDP packet.

The only requirement is the running of Punkbuster on the server while
for exploiting the vulnerability will be used the PB_Y (YPG server) or
the PB_U (UCON) packets with a content of about 1024 bytes.

Exists also another minor problem which can be exploited only versus
the Windows dedicated server (ever with Punkbuster enabled) since the
chars printed on the console are not filtered so using invalid chars or
0x07 (the bell) can cause the freezing of the entire server.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/aaboompb.zip


#######################################################################

======
4) Fix
======


No fix.
The bug is public from the 18 Aug 2007 and the developers of the engine
are aware of it from some weeks before that date.


#######################################################################


--- 
Luigi Auriemma
http://aluigi.org
http://forum.aluigi.org
http://mirror.aluigi.org

Powered by blists - more mailing lists