bugtraq - Server buffer overflow in Pure Faction <= 3.0c

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 13 May 2015 10:28:48 GMT
From: soulsgetnothing@...mail.comtyg*
To: bugtraq@...urityfocus.com
Subject: Server buffer overflow in Pure Faction <= 3.0c

Application: Pure Faction
http://www.purefaction.org
Versions: <= 3.0c
Platforms: Windows
Bug: server buffer overflow
Risk: highly critical
Exploitation: remote and automatic (requires attacker to have joined server)
Date: 13 Mar 2015
Author: soulsgetnothing
e-mail: soulsgetnothing (at) hotmail (dot) com [email concealed]
web: none

*
Pure Faction is an unofficial third-party patch for Red Faction, an FPS game developed by Volition. (http://www.volition-inc.com)

*
After a client joins a server, a null-terminated text string can be sent with in-game chat, however when the text is bigger than 519 bytes, the return address is overwritten via stack overflow.  Clients are not affected.

The instruction that does this is in 3.0c is: .text:10013A18 rep movsd

The attacker will have full control over any server that he can join.

*
No fix.
Developers have been contacted, though they do not seem concerned with making a fix.